Platform
linux
Component
vim
Fixed in
9.2.0316
This vulnerability affects Vim, a popular open-source command-line text editor. A command injection flaw exists in the netbeans interface, allowing a malicious netbeans server to execute arbitrary Ex commands. This impacts versions 9.2.0000 through 9.2.0316. The vulnerability is resolved in version 9.2.0316.
An attacker controlling a malicious netbeans server can exploit this vulnerability to gain arbitrary command execution within the Vim process. This could lead to data theft, system compromise, or further malicious activity. The attacker could potentially read sensitive files, install malware, or even gain persistent access to the system. The blast radius is limited to the system running Vim and connected to the malicious netbeans server, but the consequences can be severe.
This vulnerability was publicly disclosed on 2026-04-08. No public proof-of-concept exploits are currently known. The EPSS score is pending evaluation. While no active exploitation campaigns have been reported, the ease of exploitation makes it a potential target for opportunistic attackers.
Exploit Status
EPSS
0.16% (37% percentile)
CISA SSVC
CVSS Vector
The primary mitigation is to upgrade Vim to version 9.2.0316 or later. If upgrading is not immediately feasible, consider isolating Vim instances from untrusted netbeans servers. Disabling the netbeans interface entirely is another option, though it will impact functionality. Monitor network traffic for suspicious connections to netbeans servers. After upgrading, confirm the fix by attempting to connect to a known malicious netbeans server and verifying that no arbitrary commands are executed.
Update to version 9.2.0316 or later to mitigate the Ex command injection vulnerability. This update corrects the issue by properly sanitizing strings in the NetBeans interface protocol messages, preventing the execution of arbitrary commands.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-39881 is a command injection vulnerability in Vim's netbeans interface, allowing malicious servers to execute commands.
You are affected if you are using Vim versions 9.2.0000 through 9.2.0316 and connect to netbeans servers.
Upgrade Vim to version 9.2.0316 or later. Consider disabling the netbeans interface if upgrading is not possible.
No active exploitation campaigns have been reported, but the vulnerability is considered a potential target.
Refer to the Vim project's security advisories on their official website for the latest information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.