Log in Start free

Vulnerability · Published Mar 24, 2026 · Assigned by GitHub_M

CVE-2026-33412Vim affected by Command injection via newline in glob()

Medium 5.6

In plain English

A medium-severity OS command injection in vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.6Medium
Exploit odds (30 days)0.9%top 41.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8vim-X112:8.0.1763-22.el8_10.1ALSA-2026:6915
AlmaLinux:9vim-X112:8.2.2637-23.el9_7.2ALSA-2026:8259
AlmaLinux:8vim-common2:8.0.1763-22.el8_10.1ALSA-2026:6915
AlmaLinux:9vim-common2:8.2.2637-23.el9_7.2ALSA-2026:8259
AlmaLinux:10vim-data2:9.1.083-6.el10_1.3ALSA-2026:7711
AlmaLinux:8vim-enhanced2:8.0.1763-22.el8_10.1ALSA-2026:6915
AlmaLinux:9vim-enhanced2:8.2.2637-23.el9_7.2ALSA-2026:8259
AlmaLinux:10vim-filesystem2:9.1.083-6.el10_1.3ALSA-2026:7711
AlmaLinux:8vim-filesystem2:8.0.1763-22.el8_10.1ALSA-2026:6915
AlmaLinux:9vim-filesystem2:8.2.2637-23.el9_7.2ALSA-2026:8259
AlmaLinux:8vim-minimal2:8.0.1763-22.el8_10.1ALSA-2026:6915
AlmaLinux:9vim-minimal2:8.2.2637-23.el9_7.2ALSA-2026:8259
Alpine:v3.23vim9.2.0219-r0ALPINE-CVE-2026-33412
Alpine:v3.24vim9.2.0219-r0ALPINE-CVE-2026-33412
Debian:12vimno fix listedDEBIAN-CVE-2026-33412
Debian:13vim2:9.1.1230-2+deb13u1DEBIAN-CVE-2026-33412
Debian:14vim2:9.2.0218-1DEBIAN-CVE-2026-33412
Rocky Linux:10vim2:9.1.083-6.el10_1.3RLSA-2026:7711
Rocky Linux:8vim2:8.0.1763-22.el8_10.1RLSA-2026:6915
Rocky Linux:9vim2:8.2.2637-23.el9_7.2RLSA-2026:8259
Ubuntu:22.04:LTSvim2:8.2.3995-1ubuntu2.27UBUNTU-CVE-2026-33412
Ubuntu:24.04:LTSvim2:9.1.0016-1ubuntu7.11UBUNTU-CVE-2026-33412
Ubuntu:25.10vim2:9.1.0967-1ubuntu6.2UBUNTU-CVE-2026-33412

Affected products (as reported)

VendorProductVersions
vim vim < 9.2.0202

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

References