Vim Patches CVE-2026-44656, a Modeline-Triggered Shell Injection in :find Completion Affecting All Versions Up Through 9.2.0435
Vim 9.2.0435 fixes an OS command injection in :find completion where backtick-enclosed shell commands inside the path option ran during Tab completion, with a modeline-set path enabling exploitation by simply opening a malicious file.
Overview
The Vim project has released patch 9.2.0435 to fix CVE-2026-44656, an OS command injection in the editor’s :find family of commands that the GitHub Security Advisory for the issue describes as “OS Command Injection via ‘path’ completion affects Vim < 9.2.0435.” The advisory rates the issue Medium and assigns it CWE-78, the same OS-command-injection class that has surfaced repeatedly in Vim’s option-handling code over the past two months.
The NVD entry for CVE-2026-44656 was published on May 8, 2026 with a CVSS 4.0 base score of 4.6 and the vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N, indicating local attack vector with required user interaction.
What We Know
The flaw lives in the way Vim expands the path option during command-line completion. According to the GitHub Security Advisory, “The path option is used by :find Ex commands to locate files. When command-completion is invoked on these commands, the value of path is processed by expand_in_path(), which ultimately reaches mch_expand_wildcards(). The latter constructs a shell command from each path entry and any matching glob characters; in the process, text enclosed in backticks is executed by the shell.”
Two defects combine to make the issue reachable from a hostile file. The advisory states that “The expand_in_path() code path has no check for backtick expansion” and that “the path option is missing the P_SECURE flag in optiondefs.h, so a modeline can set it to a value containing backticks.” Once the modeline applies, the GitHub Security Advisory explains, “the secure global is no longer set, and the subsequent :find completion executes the backtick contents.”
The practical impact, per the advisory, is that “The vulnerability allows arbitrary shell command execution in the context of the Vim process when the user invokes :find, :sfind, :tabfind or related completion and the path option has been set to include backticks.” Severity is held to Medium because, in the advisory’s words, “exploitation requires opening an attacker-controlled file and pressing Tab during a common completion operation.”
The fix landed in Vim’s repository on May 3, 2026. The patch commit, titled “patch 9.2.0435: [security]: backticks in ‘path’ may cause shell execution on completion,” describes the remediation as: “Skip path entries containing backticks, add P_SECURE to ‘path’ option, so that it cannot be set from a modeline (for symmetry with the ‘cdpath’ option).” The change is signed off by Vim maintainer Christian Brabandt and credits GitHub user @q1uf3ng for the report, matching the acknowledgement in the GitHub Security Advisory.
Newer Vim builds are partially insulated from the worst case. The GitHub Security Advisory notes that “Vim 9.2.0350 and later are not affected from the modeline vulnerability because the 'modelinestrict' hardening prevents 'path' from being set via modeline.” That hardening, introduced earlier in the 9.2 series, blocks the modeline-driven path of attack but does not address the underlying backtick handling in expand_in_path(), which is why the 9.2.0435 patch still skips any path entry containing backticks.
What We Don’t Know
The advisory does not disclose how the bug was found or whether it has been observed in the wild; the NVD entry lists only the GitHub references and carries no exploit metadata. Distribution timelines are also not in scope: the upstream release shipped May 3, but downstream Vim packages in Debian, Ubuntu, Fedora, Red Hat, and other distributions ship on their own cadence, and none of the cited sources enumerate which distribution updates have rebased on 9.2.0435 as of NVD publication.
Analysis
CVE-2026-44656 is the latest in a steady run of modeline- and option-driven command-injection findings in Vim. The fix pattern, visible in the patch commit, pairs a defensive code change in findfile.c with the addition of a P_SECURE flag in optiondefs.h so that a modeline can no longer set the option at all. That mirrors the cdpath option’s treatment, as the commit message itself notes, and continues the trajectory begun with the modelinestrict hardening in 9.2.0350: lock down which options modelines can touch, so that future bugs in option-value expansion cannot be reached by simply opening a file.