Vim: Command injection via backtick expansion in tag filenames
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2026-41411 vim Fixed in: 9.2.0357-r0
- Debian DEBIAN-CVE-2026-41411 vim
- Ubuntu UBUNTU-CVE-2026-41411 vim Fixed in: 2:7.4.052-1ubuntu3.1+esm27
Original description The description as published by the source.
Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., command), Vim executes the embedded command via the system shell with the full privileges of the running user.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com