# [vim-security] Insecure Socket Directory in Vim < 9.2.1308

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/579) · 2026-11-08 · Security
Page: https://themorning.dev/story/vim-security-insecure-socket-directory-in-vim-9-2-1308-bd13b9f2c7244401
Kind: security · Impact: medium

## In brief

- Vim versions before 9.2.1308 create their socket directory insecurely, according to a security advisory posted on Nov 8, 2026.
- The advisory rates the issue Medium severity and cites CWE-283 (Unverified Ownership) and CWE-276 (Incorrect Default Permissions).
- A CVE identifier has been requested but not yet assigned.

## Why it matters

Developers who run Vim older than 9.2.1308, especially on shared or multi-user systems, should update, since the flaw concerns insecure default permissions on a directory Vim uses.

## What to do

- Upgrade Vim to version 9.2.1308 or later

## Versions

- Vim < 9.2.1308

## Timeline

- 2026-11-08: Insecure socket directory vulnerability in Vim disclosed on the oss-security list

## Coverage

- [[vim-security] Insecure Socket Directory in Vim < 9.2.1308](https://seclists.org/oss-sec/2026/q4/579) — Open Source Security, 2026-11-08

Tags: vim, security, vulnerability, permissions, editors

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev