CVE-2026-39881 — Vim Ex command injection in Vims NetBeans integration
Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute a…
Published: 2026-04-08 · CVSS: 5.0 · CVSS 3.1
Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7