The vulnerability resides in Neovim's secure.lua View Branch component, specifically the M.read function that processes a path argument. An attacker can manipulate this argument to inject arbitrary shell commands, causing the Neovim process to execute them. The flaw does not provide remote code execution but allows malicious commands to run on the local host where Neovim is running. The weakness is identified as CWE-74 and CWE-77, indicating improper handling of input and insecure command construction.

Neovim up to and including version 0.12.2 is affected. The vulnerability is tied to the runtime/lua/vim/secure.lua file in the View Branch component of the Neovim project.

The CVSS score of 4.8 places the vulnerability in the moderate range. EPSS information is not available, and the flaw is not listed in the CISA KEV catalog, suggesting limited widespread exploitation. Attackers can only execute the injection locally when Able to invoke Neovim and provide a crafted path argument. Since the exploit has already been published, it is accessible to attackers with local access. Overall risk is moderate, with local privilege required.