CVE-2026-33412
MEDIUMVim affected by Command injection via newline in glob()
Title source: cnaDescription
Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.
References (4)
Core 4
Core References
X_Refsource_Misc x_refsource_misc
https://github.com/vim/vim/releases/tag/v9.2.0202
X_Refsource_Confirm x_refsource_confirm
https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c
X_Refsource_Misc x_refsource_misc
https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a
Scores
CVSS v3
5.6
EPSS
0.0073
EPSS Percentile
49.5%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-78
Status
published
Products (1)
vim/vim
< 9.2.0202 (2 CPE variants)
Published
Mar 24, 2026
Tracked Since
Mar 25, 2026