CVE-2026-33412: Vim affected by Command injection via newline in glob()
Vim affected by Command injection via newline in glob()
Other sources
Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vim (glob() on Unix-like systems)to a version that resolves this vulnerability.Fixed in 9.2.0202
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33412?
CVE-2026-33412 is classified as a high-severity command injection vulnerability.
How do I fix CVE-2026-33412?
To fix CVE-2026-33412, update Vim to version 9.2.0202 or later.
Who is affected by CVE-2026-33412?
CVE-2026-33412 affects users of Vim prior to version 9.2.0202 on Unix-like systems.
What type of vulnerability is CVE-2026-33412?
CVE-2026-33412 is a command injection vulnerability that allows attackers to execute arbitrary commands.
What can an attacker achieve with CVE-2026-33412?
An attacker can exploit CVE-2026-33412 to inject and execute malicious commands through specially crafted patterns.