Uncontrolled Search Path Vulnerability in Vim for Windows

CVE-2025-66476

What is CVE-2025-66476?

Vim, the open-source command line text editor, contains a vulnerability that allows malicious executables in the current working directory to be executed inadvertently. This occurs due to how Vim resolves external commands while operating in a Windows environment using cmd.exe. Specifically, when invoking commands like grep or executing filters, Vim prioritizes the current directory over system paths. As a result, if a user is editing a file in a directory containing a malicious executable, Vim may execute this file instead of the intended command, posing significant security risks for users.

References