CVE-2026-41411: Vim: Command injection via backtick expansion in tag filenames
Last updated 13 May 2026
Other sources
Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., command), Vim executes the embedded command via the system shell with the full privileges of the running user.
— NVD
Vim: Command injection via backtick expansion in tag filenames
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.2.0524-1 - Upgrade
Upgrade
Vimto a version that resolves this vulnerability.Fixed in 9.2.0357 - Configuration
Ensure the tags file does not contain backtick syntax in the filename field (e.g., entries like `command`), because Vim will execute embedded commands via the system shell when resolving tags.
Vim (tag file processing) tag filename handling (backtick expansion) = Disable/avoid backtick syntax in tag filenames
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41411?
CVE-2026-41411 has been classified as a high severity vulnerability due to its potential for command injection.
How do I fix CVE-2026-41411?
Updating Vim to version 9.2.0357 or later will resolve the CVE-2026-41411 vulnerability.
What systems are affected by CVE-2026-41411?
CVE-2026-41411 affects all versions of Vim prior to 9.2.0357.
What is command injection in the context of CVE-2026-41411?
In CVE-2026-41411, command injection allows attackers to execute arbitrary commands through crafted tag filenames.
When was CVE-2026-41411 disclosed?
CVE-2026-41411 was disclosed as part of a security advisory from Vim addressing vulnerabilities present in earlier versions.