Vulnerability · Published May 15, 2026 · Assigned by GitHub_M
CVE-2026-46483Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag
Low 3.6
In plain English
A low-severity OS command injection in vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | vim-X11 | 2:9.1.083-9.el10_2.7 | ALSA-2026:38509 |
| AlmaLinux:8 | vim-X11 | 2:8.0.1763-27.el8_10 | ALSA-2026:38510 |
| AlmaLinux:9 | vim-X11 | 2:8.2.2637-26.el9_8.10 | ALSA-2026:38511 |
| AlmaLinux:10 | vim-common | 2:9.1.083-9.el10_2.7 | ALSA-2026:38509 |
| AlmaLinux:8 | vim-common | 2:8.0.1763-27.el8_10 | ALSA-2026:38510 |
| AlmaLinux:9 | vim-common | 2:8.2.2637-26.el9_8.10 | ALSA-2026:38511 |
| AlmaLinux:10 | vim-data | 2:9.1.083-9.el10_2.7 | ALSA-2026:38509 |
| AlmaLinux:10 | vim-enhanced | 2:9.1.083-9.el10_2.7 | ALSA-2026:38509 |
| AlmaLinux:8 | vim-enhanced | 2:8.0.1763-27.el8_10 | ALSA-2026:38510 |
| AlmaLinux:9 | vim-enhanced | 2:8.2.2637-26.el9_8.10 | ALSA-2026:38511 |
| AlmaLinux:10 | vim-filesystem | 2:9.1.083-9.el10_2.7 | ALSA-2026:38509 |
| AlmaLinux:8 | vim-filesystem | 2:8.0.1763-27.el8_10 | ALSA-2026:38510 |
| AlmaLinux:9 | vim-filesystem | 2:8.2.2637-26.el9_8.10 | ALSA-2026:38511 |
| AlmaLinux:10 | vim-minimal | 2:9.1.083-9.el10_2.7 | ALSA-2026:38509 |
| AlmaLinux:8 | vim-minimal | 2:8.0.1763-27.el8_10 | ALSA-2026:38510 |
| AlmaLinux:9 | vim-minimal | 2:8.2.2637-26.el9_8.10 | ALSA-2026:38511 |
| AlmaLinux:10 | xxd | 2:9.1.083-9.el10_2.7 | ALSA-2026:38509 |
| Alpine:v3.23 | vim | 9.2.0481-r0 | ALPINE-CVE-2026-46483 |
| Alpine:v3.24 | vim | 9.2.0481-r0 | ALPINE-CVE-2026-46483 |
| Debian:12 | vim | no fix listed | DEBIAN-CVE-2026-46483 |
| Debian:13 | vim | 2:9.1.1230-2+deb13u1 | DEBIAN-CVE-2026-46483 |
| Debian:14 | vim | 2:9.2.0524-1 | DEBIAN-CVE-2026-46483 |
| Rocky Linux:10 | vim | 2:9.1.083-9.el10_2.7 | RLSA-2026:38509 |
| Rocky Linux:8 | vim | 2:8.0.1763-27.el8_10 | RLSA-2026:38510 |
| Rocky Linux:9 | vim | 2:8.2.2637-26.el9_8.10 | RLSA-2026:38511 |
| Ubuntu:22.04:LTS | vim | 2:8.2.3995-1ubuntu2.31 | UBUNTU-CVE-2026-46483 |
| Ubuntu:24.04:LTS | vim | 2:9.1.0016-1ubuntu7.15 | UBUNTU-CVE-2026-46483 |
| Ubuntu:25.10 | vim | 2:9.1.0967-1ubuntu6.6 | UBUNTU-CVE-2026-46483 |
| Ubuntu:26.04:LTS | vim | 2:9.1.2141-1ubuntu4.3 | UBUNTU-CVE-2026-46483 |
Affected products (as reported)
Weakness: CWE-78, CWE-88 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
References
- https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w x_refsource_CONFIRM
- https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1 x_refsource_MISC
- https://github.com/vim/vim/releases/tag/v9.2.0479 x_refsource_MISC