This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-39881 →

ALPINE-CVE-2026-39881

Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious n...

Original description

The description as published by the source.

Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Alpine:v3.23 vim

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0321-r0"}]}]

References

advisory security.alpinelinux.org