CVE-2026-11487 Details
Description
A flaw has been found in Neovim up to 0.12.2. Affected by this issue is the function M.read of the file runtime/lua/vim/secure.lua of the component View Branch. Executing a manipulation of the argument path can lead to command injection. It is possible to launch the attack on the local host. The exploit has been published and may be used. This patch is called f83e0dcaf8cf18de94828341b0a1a61a86c75baf. A patch should be applied to remediate this issue.
A command injection vulnerability has been identified in Neovim versions prior to 0.12.2. The issue arises in the View Branch component, specifically within the M.read function of runtime/lua/vim/secure.lua. The vulnerability allows for the injection and execution of additional Ex commands by manipulating the path argument. This exploitation occurs locally, breaking the security boundary intended for handling untrusted files.
Users can update to Neovim version 0.12.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 8, 2026CISA-ADP
Assessed Jun 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/neovim/neovim/ | [email protected] | Vendor |
| https://github.com/neovim/neovim/commit/f83e0dcaf8cf18de94828341b0a1a61a86c75baf | [email protected] | Source CodeVendor |
| https://github.com/neovim/neovim/issues/39914 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/neovim/neovim/pull/39918 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-11487 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/834495 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/369107 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/369107/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Neovim | <= 0.12.2 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | New CVE Received | [email protected] |