CVE-2026-46483: Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag
Last updated 9 June 2026
Other sources
Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479.
— MITRE
Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.2.0524-1 - Upgrade
Upgrade
Vimto a version that resolves this vulnerability.Fixed in 9.2.0479
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46483?
CVE-2026-46483 is considered a medium-severity vulnerability due to the risk of command injection.
How do I fix CVE-2026-46483?
To fix CVE-2026-46483, users should upgrade Vim to version 9.2.0479 or later.
What versions of Vim are affected by CVE-2026-46483?
Vim versions prior to 9.2.0479 are affected by CVE-2026-46483.
What types of systems are impacted by CVE-2026-46483?
CVE-2026-46483 impacts Unix-like systems when using Vim to decompress .tgz archives.
What is the nature of the vulnerability in CVE-2026-46483?
CVE-2026-46483 is a command injection vulnerability caused by a missing shellescape flag in the tar#Vimuntar function.