Vim’s NetBeans integration contains a command injection flaw that allows a malicious NetBeans server to send unsanitized strings to the Vim client. These strings are interpreted as Ex commands by Vim, giving the attacker the ability to run arbitrary commands on the machine where Vim is executing. The vulnerability stems from insufficient input validation in the defineAnnoType and specialKeys protocol messages.

All Vim releases older than 9.2.0316 that enable the NetBeans integration feature are affected. Users who run Vim and connect to any NetBeans server are at risk, irrespective of the operating system, as long as the Vim client is using the vulnerable integration.

The CVSS score of 5 indicates a moderate risk level and the EPSS score is unavailable, meaning the likely exploitation probability is not quantified. The vulnerability is not part of the CISA KEV catalog. Based on the description, it is inferred that the attacker must control the NetBeans server that the Vim client connects to, and the command injection occurs during the establishment of that connection. Exploitability therefore depends on the presence of an attacker‑controlled NetBeans service that the victim chooses to connect to or is automatically connected to through configuration.