Vim insecure socket directory in versions before 9.2.1308

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: Vim users running versions before 9.2.1308

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

Popular tool

What to do

Upgrade Vim to version 9.2.1308 or later

The Brief

Vim versions before 9.2.1308 create their socket directory insecurely, according to a security advisory posted on Nov 8, 2026.
The advisory rates the issue Medium severity and cites CWE-283 (Unverified Ownership) and CWE-276 (Incorrect Default Permissions).
A CVE identifier has been requested but not yet assigned.

Why it matters

Developers who run Vim older than 9.2.1308, especially on shared or multi-user systems, should update, since the flaw concerns insecure default permissions on a directory Vim uses.

The checklist behind the tier

Checklist · 2 of 10 yes

Yes	Hits tech teams	Vim is a text editor that developers use daily, so it counts as developer tooling.
No	Core infrastructure	Vim is a single editor, not shared infrastructure like OpenSSH or the Linux kernel.
Yes	Popular tool	Vim is a widely used developer editor across many teams.
No	Exploited in the wild	Open Source Security advisory describes a vulnerability only; it reports no observed attacks.
No	Public exploit	Open Source Security advisory gives no published exploit code or proof-of-concept.
No	Remote, no login	Open Source Security advisory describes an insecure local socket directory, not unauthenticated network access.
No	Full takeover	Open Source Security advisory does not state code execution or privilege escalation; it only reports insecure permissions.
No	Secrets exposed	Open Source Security advisory reports no stolen or exposed credentials, keys or data.
No	Supply chain	Open Source Security advisory reports no compromised package, update or build pipeline.
No	No fix yet	Open Source Security advisory says fixed in Vim 9.2.1308, so a patched version exists.

Timeline

Nov 8
Insecure socket directory vulnerability in Vim disclosed on the oss-security list
Nov 8 · 11:45 PM
Open Source Security
[vim-security] Insecure Socket Directory in Vim < 9.2.1308

Source

[vim-security] Insecure Socket Directory in Vim < 9.2.1308 ↗ Open Source Security · 3h ago

First seen 3h ago · 1 source · Full story page · How tiers are decided