Vim is a widely used command-line text editor maintained by a small project with a focused product scope, making its vulnerability footprint correspondingly modest. The limited public disclosures associated with the project lack sufficient detail for structural pattern analysis, though defenders should monitor this vendor given Vim's prevalence across development environments and system administration workflows. Current exposure counts and severity breakdown are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Vim Project over time
Signals from CVEs in this vendor scope (252 CVEs).
252 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-12735HIGH getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute | Jun 5, 2019 | 8.6 | 48 | NO | YES |
CVE-2008-2712HIGH Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the ex | Jun 16, 2008 | 9.3 | 43 | NO | YES |
CVE-2022-0572HIGH Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. | Feb 14, 2022 | 7.8 | 41 | NO | NO |
CVE-2008-4101HIGH Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell commands by entering a K keystroke on a | Sep 18, 2008 | 9.3 | 39 | NO | YES |
CVE-2026-59856HIGH Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken fro | Jul 9, 2026 | 7.8 | 37 | NO | NO |
CVE-2026-47162HIGH Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pa | Jun 11, 2026 | 8.8 | 37 | NO | NO |
CVE-2008-3076HIGH The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system funct | Feb 21, 2009 | 9.3 | 37 | NO | YES |
CVE-2026-59858HIGH Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension | Jul 9, 2026 | 7.8 | 36 | NO | NO |
CVE-2026-57456HIGH Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes r | Jun 25, 2026 | 7.8 | 35 | NO | NO |
CVE-2026-34714HIGH Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking | Mar 30, 2026 | 8.6 | 35 | NO | NO |
Signals from CVEs in this vendor scope (252 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Vim Project.
Media articles that mention a CVE ID that affects a product developed by Vim Project — matched by CVE ID, not by vendor name.