CVE-2026-41411

Published: Apr 24, 2026Modified: Jun 17, 2026

6.6

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

Exploitability: 1.8 / Impact: 4.7

Source: security-advisories@github.com (Secondary)

Description

Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.

Affected (1)

Products: Vim: Vim

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Vim Vim	Before 9.2.0357

Related CWEs

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (3)

https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb

Source: security-advisories@github.com

Patch

https://github.com/vim/vim/releases/tag/v9.2.0357

Source: security-advisories@github.com

Product

https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8

Source: security-advisories@github.com

PatchVendor Advisory

Timeline

No history available yet.