Vim for Windows ships a high‑severity local code‑execution flaw that can let a malicious file in a project folder run with the privileges of the user simply because the editor invoked an external command; the bug is tracked as CVE‑2025‑66476 and is fixed in Vim v9.1.1947 — users and...