PT-2026-47249 · Neovim · Neovim

Nanhang · Published 2026-06-08 · Updated 2026-06-08 · CVE-2026-11487

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Neovim versions prior to 0.12.3

Description A flaw in the View Branch component allows for command injection via the local host. The issue exists within the M.read() function located in the runtime/lua/vim/secure.lua file, where manipulating the path argument can lead to arbitrary command execution.

Recommendations Apply patch f83e0dcaf8cf18de94828341b0a1a61a86c75baf to remediate the issue. As a temporary workaround, restrict or avoid the use of the M.read() function in runtime/lua/vim/secure.lua when handling untrusted path arguments.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-11487

Affected Products

Neovim

References · 10

• 🔥 https://github.com/neovim/neovim/issues/39914 · Exploit
• https://github.com/neovim/neovim/pull/39918 · Patch
• https://github.com/neovim/neovim/commit/f83e0dcaf8cf18de94828341b0a1a61a86c75baf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-11487 · Security Note
• https://vuldb.com/vuln/369107 · Note
• https://twitter.com/VulmonFeeds/status/2063862404711162156 · Twitter Post
• https://vuldb.com/submit/834495 · Note
• https://vuldb.com/cve/CVE-2026-11487 · Note
• https://vuldb.com/vuln/369107/cti · Note
• https://github.com/neovim/neovim · Note