Vim for Windows Vulnerability Let Attackers Execute Arbitrary Code

A high-severity vulnerability (CVE-2025-66476) affecting Vim for Windows (versions before 9.1.1947) allows attackers to achieve arbitrary code execution by placing malicious executables in the current working directory; Vim previously searched the working directory before system directories when invoking external commands. The advisory notes a CVSS score of 7.8, describes common attack scenarios (e.g., cloned malicious repos triggering grep/make), and recommends immediate update to Vim/gVim version 9.1.1947 or later to mitigate the issue.