CVE-2026-57453

Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.vim falls back to PowerShell to browse, read, extract, update or delete entries in a zip archive, it builds the PowerShell command by inserting archive entry names that are quoted only for the shell, not for PowerShell. A crafted entry name can break out of the intended string context and cause PowerShell to execute arbitrary commands with the privileges of the user running Vim, triggered by opening, viewing or extracting the archive. This vulnerability is fixed in 9.2.0678.

• CWE-77

• https://github.com/vim/vim/commit/b2cc9be119d51212bf0d3f2a99Patch
• https://github.com/vim/vim/releases/tag/v9.2.0678Product
• https://github.com/vim/vim/security/advisories/GHSA-x5fg-h5w9-9frfVendor Advisory

Published

Jun 25, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57437Nokogiri is an open source XML and HTML library for the Ruby…5.3
• CVE-2026-57438Nokogiri is an open source XML and HTML library for the Ruby…6.6
• CVE-2026-57439CyberChef is a web app for encryption, encoding, compression…5
• CVE-2026-5745A flaw was found in libarchive. A NULL pointer dereference v…5.5
• CVE-2026-57451Vim is an open source, command line text editor. Prior to 9.…6.1
• CVE-2026-57452Vim is an open source, command line text editor. Prior to 9.…5.5
• CVE-2026-57454Vim is an open source, command line text editor. From 9.2.03…6.1
• CVE-2026-57455Vim is an open source, command line text editor. Prior to 9.…7.8
• CVE-2026-57456Vim is an open source, command line text editor. Prior to 9.…7.8
• CVE-2026-5747An out-of-bounds write issue in the virtio PCI transport in …8.7
• CVE-2026-57473A vulnerability exists in the netclient and factory services…5.8
• CVE-2026-57474Deloitte AI Assist for Customer disclosed some configuration…6.9