Skip to main content

Vim EUVDEUVD-2026-25575

| CVE-2026-41411 MEDIUM
OS Command Injection (CWE-78)
2026-04-24 security-advisories@github.com
Command Injection Red Hat Vim Suse
6.6
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
6.6 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
SUSE
MEDIUM
qualitative
Red Hat
7.3 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
Low

Lifecycle Timeline

6
Patch released
Apr 27, 2026 - 13:39 nvd
Patch available
Patch available
Apr 24, 2026 - 18:01 EUVD
Analysis Generated
Apr 24, 2026 - 17:32 vuln.today
EUVD ID Assigned
Apr 24, 2026 - 17:22 euvd
EUVD-2026-25575
Analysis Generated
Apr 24, 2026 - 17:22 vuln.today
CVE Published
Apr 24, 2026 - 17:16 nvd
MEDIUM 6.6

DescriptionGitHub Advisory

Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., command), Vim executes the embedded command via the system shell with the full privileges of the running user.

AnalysisAI

Command injection in Vim's tag file processing allows local attackers to execute arbitrary shell commands with user privileges when resolving tags containing backtick syntax. Versions prior to 9.2.0357 are affected. The vulnerability requires user interaction (opening a crafted tags file or navigating to a tag), but once triggered, grants full command execution capability in the context of the Vim process.

Technical ContextAI

Vim's tag resolution mechanism processes tag files to navigate code definitions. The vulnerability resides in the filename field parsing logic, where wildcard expansion is applied to resolve environment variables and glob patterns. When this expansion encounters backtick syntax (command substitution, a shell metacharacter), the embedded command is executed via system shell invocation rather than being treated as literal filename text. This occurs during tag lookup when users press Ctrl-] or similar tag-jump commands. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) identifies the root cause: insufficient input validation and sanitization before shell command construction.

RemediationAI

Upgrade to Vim 9.2.0357 or later from https://github.com/vim/vim/releases/tag/v9.2.0357. Patch details are available in the security advisory at https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8. As an interim compensating control, users should audit tags files for backtick syntax (command substitution patterns) before opening or navigating tags, particularly from untrusted sources or public repositories. Additionally, restricting write access to tags files to trusted users and scanning version control systems for malicious tags entries can reduce attack surface. Note that disabling tag functionality entirely (via setting 'tags=' to empty) eliminates the vulnerability but removes tag-jump convenience features.

More in Vim

View all
CVE-2022-3520 CRITICAL POC
9.8 Dec 02

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. Rated critical severity (CVSS 9.8), this vuln
CVE-2022-0729 HIGH POC
8.8 Feb 23

Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this

CVE-2026-34714 HIGH POC
8.6 Mar 30

Code execution vulnerability in Vim before 9.2.0272 allows attackers to gain immediate arbitrary command execution upon

CVE-2019-12735 HIGH POC
8.6 Jun 05

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via th
CVE-2021-3968 HIGH POC
8.0 Nov 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 8.0), this vulnerability is remotely exploita
CVE-2023-4735 HIGH POC
7.8 Sep 02

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847. Rated high severity (CVSS 7.8), this vulnerability i
CVE-2023-4781 HIGH POC
7.8 Sep 05

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. Rated high severity (CVSS 7.8), this vulnerab
CVE-2023-4734 HIGH POC
7.8 Sep 02

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846. Rated high severity (CVSS 7.8), this vuln
CVE-2023-4733 HIGH POC
7.8 Sep 04

Use After Free in GitHub repository vim/vim prior to 9.0.1840. Rated high severity (CVSS 7.8), this vulnerability is no

CVE-2023-4750 HIGH POC
7.8 Sep 04

Use After Free in GitHub repository vim/vim prior to 9.0.1857. Rated high severity (CVSS 7.8), this vulnerability is no

CVE-2023-4736 HIGH POC
7.8 Sep 02

Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833. Rated high severity (CVSS 7.8), this vulnerability
CVE-2023-2610 HIGH POC
7.8 May 09

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. Rated high severity (CVSS 7.8), this vuln

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

Share

EUVD-2026-25575 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy