SecurityFan score 21 · Tier C
[vim-security] Insecure Socket Directory in Vim < 9.2.1308
The Brief
- Vim versions before 9.2.1308 create their socket directory insecurely, according to a security advisory posted on Nov 8, 2026.
- The advisory rates the issue Medium severity and cites CWE-283 (Unverified Ownership) and CWE-276 (Incorrect Default Permissions).
- A CVE identifier has been requested but not yet assigned.
Why it matters
Developers who run Vim older than 9.2.1308, especially on shared or multi-user systems, should update, since the flaw concerns insecure default permissions on a directory Vim uses.
Who’s affected
- Vim users running versions before 9.2.1308
What to do
- Upgrade Vim to version 9.2.1308 or later
- Vim < 9.2.1308
- #vim
- #security
- #vulnerability
- #permissions
- #editors
Posted by Christian Brabandt on Nov 08 Insecure Socket Directory in Vim < 9.2.1308 =========================================== Date: 08.11.2026 Severity: Medium CVE: *requested, not yet assigned* CWE: Unverified Ownership (CWE-283), Incorrect Default Permissions (CWE-276) ##…
Timeline
Insecure socket directory vulnerability in Vim disclosed on the oss-security list
Open Source Security
[vim-security] Insecure Socket Directory in Vim < 9.2.1308