Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade vim | May 20, 2026 | May 15, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Aug 26, 2026 | May 15, 2026 |
| Redhat_linux | — | Upgrade vim-dataUpgrade vim-debuginfoUpgrade xxd-debuginfoUpgrade xxdUpgrade vim-commonUpgrade vim-X11Upgrade vim-minimal-debuginfoUpgrade vim-minimalUpgrade vim-filesystemUpgrade vim-debugsourceUpgrade vim-common-debuginfoUpgrade vim-enhancedUpgrade vim-X11-debuginfoUpgrade vim-enhanced-debuginfo | Jun 24, 2026 | May 15, 2026 |
| Rocky_linux | — | Upgrade vim-commonUpgrade vim-X11Upgrade vim-minimal-debuginfoUpgrade vim-enhanced-debuginfoUpgrade vim-debuginfoUpgrade vim-minimalUpgrade vim-enhancedUpgrade vim-debugsourceUpgrade vim-common-debuginfoUpgrade vim-X11-debuginfo | Aug 13, 2026 | Aug 11, 2026 |
| Ubuntu | — | Upgrade vim-motifUpgrade vimUpgrade xxdUpgrade vim-tinyUpgrade vim-gtk-py2 (Ubuntu Pro)Upgrade vim-gtk3Upgrade vim-athena-py2 (Ubuntu Pro)Upgrade vim-gnome (Ubuntu Pro)Upgrade vim-gtk3 (Ubuntu Pro)Upgrade vim-gtk (Ubuntu Pro)Upgrade vim-lesstif (Ubuntu Pro)Upgrade xxd (Ubuntu Pro)Upgrade vim-gtk3-py2 (Ubuntu Pro)Upgrade vim-common (Ubuntu Pro)Upgrade vim-gnome-py2 (Ubuntu Pro)Upgrade vim-gtkUpgrade vim-nox (Ubuntu Pro)Upgrade vim-tiny (Ubuntu Pro)Upgrade vim-commonUpgrade vim-gui-common (Ubuntu Pro)Upgrade vim-athena (Ubuntu Pro)Upgrade vim-runtimeUpgrade vim-gui-commonUpgrade vim-athenaUpgrade vim-runtime (Ubuntu Pro)Upgrade vim-nox-py2 (Ubuntu Pro)Upgrade vim (Ubuntu Pro)Upgrade vim-nox | Jun 16, 2026 | Jun 9, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub