Login Request a demo
Medium severity · published Jun 8, 2026
CVE-2026-11487
Neovim View Branch secure.lua M.read command injection
5.3
CVSS
0.9%
EPSS
No
On KEV
Description
A flaw has been found in Neovim up to 0.12.2. Affected by this issue is the function M.read of the file runtime/lua/vim/secure.lua of the component View Branch. Executing a manipulation of the argument path can lead to command injection. It is possible to launch the attack on the local host. The exploit has been published and may be used. This patch is called f83e0dcaf8cf18de94828341b0a1a61a86c75baf. A patch should be applied to remediate this issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Neovim · Neovim
0.12.0; 0.12.1; 0.12.2 · source: vendor
Affected product
NE
Neovim
Neovim
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11487
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11487
github.com
https://github.com/neovim/neovim/
github.com
https://github.com/neovim/neovim/commit/f83e0dcaf8cf18de94828341b0a1a61a86c75baf
github.com
https://github.com/neovim/neovim/issues/39914
github.com
https://github.com/neovim/neovim/pull/39918
vuldb.com
https://vuldb.com/cve/CVE-2026-11487
vuldb.com
https://vuldb.com/submit/834495
More from Neovim
8.6
CVE-2019-12735
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by…
7.8
CVE-2023-5535
Use After Free in GitHub repository vim/vim prior to v9.0.2010
7.8
CVE-2023-4781
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873
7.8
CVE-2023-4752
Use After Free in GitHub repository vim/vim prior to 9.0.1858
7.8
CVE-2023-4750
Use After Free in GitHub repository vim/vim prior to 9.0.1857