Vim CVE-2026-57453

Exploitation requires that Vim's bundled zip plugin (autoload/zip.vim) use its PowerShell fallback path - i.e. a host (effectively Windows) where archive browse/read/extract/update/delete is handled via pwsh/.NET System.IO.Compression rather than native GNU unzip/zip - and that the victim open, view or extract an attacker-supplied zip archive containing a maliciously crafted entry name. Limiting factors: it is not remote-network exploitable (AV:L) and demands user interaction (UI:R) to open the archive; it requires no privileges or authentication (PR:N) and runs only with the opening user's privileges; and Linux/macOS deployments using the standard unzip/zip tools do not reach the vulnerable PowerShell branch, narrowing exposure primarily to Windows users who open untrusted archives in vulnerable Vim builds (9.1.1784 to <9.2.0678).

The CVSS 3.1 base score is 7.3 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L: local attack vector because the malicious archive must reach the victim and be opened, low complexity, no privileges, but required user interaction. No EPSS score was provided, the CVE is not in CISA KEV, and no POC or active-exploitation signal is present, so this should be treated as a latent code-execution risk rather than an under-active-attack emergency. An important conditional limiter not reflected in the raw score is that the injectable PowerShell path only executes on deployments that fall back to PowerShell (effectively Windows hosts using the .NET/pwsh branch instead of native unzip/zip); on Linux/macOS systems using the GNU tools this specific branch is not reached. The C:H/I:H/A:L impact is conservative for what is effectively arbitrary command execution as the user - integrity and confidentiality of anything the user can access are fully at stake. Net: a real priority to patch on Windows developer/analyst workstations that open untrusted archives in Vim, but lower urgency where the PowerShell fallback is never used.

An attacker emails or hosts a booby-trapped .zip whose internal entry name contains PowerShell breakout syntax, then lures a Windows-based developer or analyst into opening or previewing it in Vim. Because Vim's zip plugin auto-browses the archive and builds a PowerShell command from the entry name without PowerShell-safe escaping, the embedded commands run with the victim's privileges the moment the archive is viewed. No public exploit code has been identified at time of analysis, but the low-complexity, no-privilege nature means a working payload would be straightforward for a capable attacker to craft.