CVE catalog

CVE-2026-11487

A flaw has been found in Neovim up to 0.12.2. Affected by this issue is the function M.read of the file runtime/lua/vim/secure.lua of the component View Branch. Executing a manipulation of the argumen

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.92% · Oct 25, 2026

A flaw has been found in Neovim up to 0.12.2. Affected by this issue is the function M.read of the file runtime/lua/vim/secure.lua of the component View Branch. Executing a manipulation of the argument path can lead to command injection. It is possible to launch the attack on the local host. The exploit has been published and may be used. This patch is called f83e0dcaf8cf18de94828341b0a1a61a86c75baf. A patch should be applied to remediate this issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianneovimsid0.12.4-1fixed
Debianneovimforky0.12.4-1fixed
Debianneovimtrixie0.10.4-8vulnerable
Debianneovimbookworm0.7.2-7not affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianneovimsourcesid0.12.3-1not yet assignedNot reported[1139999]
Debianneovimsourceforky0.12.3-1not yet assignedNot reported[1139999]
Debianneovimsourcetrixie(unfixed)not yet assignedNot reported[1139999]
DebianneovimsourcebookwormNot affectedunimportantNot reported[1139999]

[Debian bug #1139999]

Notes

[trixie] neovim: Minor issue

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [neovim]Affected
    Details (2)

    • 0.10.4-8 · amd64 · trixie

      Affected

      nvd · neovim · debian · 13

    • 0.10.4-8 · arm64 · trixie

      Affected

      nvd · neovim · debian · 13

  • [neovim-runtime]Affected

    Source package: [neovim]

    Details (2)

    • 0.10.4-8 · all · trixie

      Affected

      nvd · neovim · debian · 13

    • 0.10.4-8 · all · trixie

      Affected

      nvd · neovim · debian · 13

[Debian 12 (Bookworm)]

  • [neovim]Not affected
    Details (2)

    • 0.7.2-7 · amd64 · bookworm

      Not affected

      nvd · neovim · debian · bookworm

    • 0.7.2-7 · arm64 · bookworm

      Not affected

      nvd · neovim · debian · bookworm

  • [neovim-runtime]Not affected

    Source package: [neovim]

    Details (2)

    • 0.7.2-7 · all · bookworm

      Not affected

      nvd · neovim · debian · bookworm

    • 0.7.2-7 · all · bookworm

      Not affected

      nvd · neovim · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]