CVE-2026-11487

Published: Giu 08, 2026 Last Modified: Giu 08, 2026
ExploitDB:
Other exploit source:
Google Dorks:
LOW 1,9
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 5,3
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: low
MEDIUM 4,3
Source: [email protected]
Access Vector: local
Access Complexity: low
Authentication: single
Confidentiality: partial
Integrity: partial
Availability: partial

Description

AI Translation Available

A flaw has been found in Neovim up to 0.12.2. Affected by this issue is the function M.read of the file runtime/lua/vim/secure.lua of the component View Branch. Executing a manipulation of the argument path can lead to command injection. It is possible to launch the attack on the local host. The exploit has been published and may be used. This patch is called f83e0dcaf8cf18de94828341b0a1a61a86c75baf. A patch should be applied to remediate this issue.

74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Incomplete
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Access Control Other Integrity Non-Repudiation
Potential Impacts:
Read Application Data Bypass Protection Mechanism Alter Execution Logic Other Hide Activities
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: High
View CWE Details
77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability
Potential Impacts:
Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies: AI/ML
Likelihood of Exploit: High
View CWE Details
https://github.com/neovim/neovim/
https://github.com/neovim/neovim/
https://github.com/neovim/neovim/commit/f83e0dcaf8cf18de948…
https://github.com/neovim/neovim/commit/f83e0dcaf8cf18de94828341b0a1a61a86c75baf
https://github.com/neovim/neovim/issues/39914
https://github.com/neovim/neovim/issues/39914
https://github.com/neovim/neovim/pull/39918
https://github.com/neovim/neovim/pull/39918
https://vuldb.com/cve/CVE-2026-11487
https://vuldb.com/cve/CVE-2026-11487
https://vuldb.com/submit/834495
https://vuldb.com/submit/834495
https://vuldb.com/vuln/369107
https://vuldb.com/vuln/369107
https://vuldb.com/vuln/369107/cti
https://vuldb.com/vuln/369107/cti