Vim, a widely‑used command‑line editor, contains a flaw in shell‑keyword lookup plugins that passes user‑controlled visual selections directly into shell commands without proper escaping. The vulnerability is a classic command‑injection fault (CWE‑78) and can result in arbitrary operating‑system commands executing with the privileges of the Vim process. An attacker who can inject a selection in a shell, zsh, or PowerShell filetype context can freely read or tamper with files, elevate local privileges, or establish persistence on the host.

The flaw affects Vim versions earlier than 9.2.0839 distributed by the vim:vim vendor. Any installation running the ftplugin scripts for sh, zsh or ps1 filetypes is vulnerable. The issue is mitigated only by upgrading to Vim 9.2.0839 or later.

The CVSS score of 8.4 indicates a high severity, but the EPSS score of less than 1 % suggests a very low current exploitation probability. It is not listed in the CISA KEV catalog, implying no widespread known exploitation yet. The attack vector requires the attacker to be able to supply a visual selection or modify a buffer, so it is limited to local users or compromised sessions with editor access. Nonetheless, the impact remains severe if the attacker succeeds.