Vim up to 9.1.1946 on Windows cmd.exe uncontrolled search path

Summaryinfo

A vulnerability was found in Vim up to 9.1.1946 on Windows. It has been classified as problematic. The impacted element is an unknown function of the file cmd.exe. Performing a manipulation results in uncontrolled search path. This vulnerability was named CVE-2025-66476. The attack needs to be approached locally. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical has been found in Vim up to 9.1.1946 on Windows. This affects an unknown code block of the file cmd.exe. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. CWE is classifying the issue as CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Vim is an open source, command line text editor. Prior to version 9.1.1947, an uncontrolled search path vulnerability on Windows allows Vim to execute malicious executables placed in the current working directory for the current edited file. On Windows, when using cmd.exe as a shell, Vim resolves external commands by searching the current working directory before system paths. When Vim invokes tools such as findstr for :grep, external commands or filters via :!, or compiler/:make commands, it may inadvertently run a malicious executable present in the same directory as the file being edited. The issue affects Vim for Windows prior to version 9.1.1947.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-66476 since 12/02/2025. The exploitability is told to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 277418 (Linux Distros Unpatched Vulnerability : CVE-2025-66476), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.1.1947 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 083ec6d9a3b7b09006e0ce69ac802597d25 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (277418), EUVD (EUVD-2025-200373) and CERT Bund (WID-SEC-2025-2719). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Open Source vim

Productinfo

Type

• Word Processing Software

Name

• Vim

Version

• 9.1.1946

License

• open-source

Website

• Product: https://github.com/vim/vim/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion