Vim's :find completion can execute shell commands embedded in backticks within the path option. Because the path option can be set via a modeline and lacks a security flag, an attacker who can inject a modeline into a file may cause those commands to run when the file is opened and the :find completion is used, allowing execution of arbitrary shell commands with the privileges of the Vim user. The vulnerability does not provide denial of service or direct data disclosure; the impact is limited to command execution in the context of the Vim process.

Vim releases prior to version 9.2.0435 are affected. All versions of Vim before that tag are vulnerable, and the patch is included in 9.2.0435. The vendor target is vim:vim.

With a CVSS score of 4.6 the vulnerability is considered moderate. No EPSS score is available, and it is not listed in the CISA KEV catalog. The attack requires a malicious file that contains a modeline and a user who opens that file and triggers :find completion, so user interaction is required. When these conditions are met, the attacker can execute arbitrary shell commands with the privileges of the Vim user; however, this does not automatically lead to full system compromise unless the Vim user has elevated privileges.