CVE-2026-33412

MEDIUM

Vim affected by Command injection via newline in glob()

Title source: cna
STIX 2.1

Description

Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.

References (37)

Core 37
Core References
X_Refsource_Misc x_refsource_misc
https://github.com/vim/vim/releases/tag/v9.2.0202

Scores

CVSS v3 5.6
EPSS 0.0083
EPSS Percentile 54.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (1)
vim/vim < 9.2.0202 (2 CPE variants)
Published Mar 24, 2026
Tracked Since Mar 25, 2026