Detections
Analytics

Echo: vim: security update to 2:9.2.0858-1

high Tenable Self-Hosted Container Security Plugin ID 462414

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin
 autoload/zip.vim falls back to PowerShell to browse, read, extract, update or delete entries in a zip
 archive, it builds the PowerShell command by inserting archive entry names that are quoted only for the
 shell, not for PowerShell. A crafted entry name can break out of the intended string context and cause
 PowerShell to execute arbitrary commands with the privileges of the user running Vim, triggered by
 opening, viewing or extracting the archive. This vulnerability is fixed in 9.2.0678. (CVE-2026-57453)

Solution

Update the vim library and its related packages to version 2:9.2.0858-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-57453

Plugin Details

Severity: High

ID: 462414

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.5

Percentile: 57.55

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:P

CVSS Score Source: CVE-2026-57453

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.4

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/26/2026

Vulnerability Publication Date: 6/25/2026

Reference Information

CVE: CVE-2026-57453

IAVA: 2026-A-0630-S