Ex command injection in Vim's NetBeans integration before v9.2.0316. The netbeans defineAnnoType command passes typeName, fg and bg unsanitized to coloncmd(), allowing a malicious NetBeans server to inject arbitrary Ex commands via '|'. Similarly, specialKeys does not validate key tokens before building a map command.