Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.
References
| Link | Resource |
|---|---|
| https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a | Patch |
| https://github.com/vim/vim/releases/tag/v9.2.0202 | Product |
| https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c | Patch Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/03/19/10 | Mailing List Patch Third Party Advisory |
Configurations
History
25 Mar 2026, 21:59
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* | |
| First Time |
Vim vim
Vim |
|
| References | () https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a - Patch | |
| References | () https://github.com/vim/vim/releases/tag/v9.2.0202 - Product | |
| References | () https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c - Patch, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/03/19/10 - Mailing List, Patch, Third Party Advisory |
24 Mar 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
24 Mar 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-24 20:16
Updated : 2026-03-25 21:59
NVD link : CVE-2026-33412
Mitre link : CVE-2026-33412
CVE.ORG link : CVE-2026-33412
JSON object : View
Products Affected
vim
- vim
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')