Skip to content
OpenAdvisories
High ALAS2-2026-3292 1 CVE

Important: vim security update (Amazon Linux 2)

Published May 11, 2026 · Updated May 13, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-41411: Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 vim-common 2:9.0.2153-1.amzn2.0.6
Amazon Linux · 2 vim-data 2:9.0.2153-1.amzn2.0.6
Amazon Linux · 2 vim-debuginfo 2:9.0.2153-1.amzn2.0.6
Amazon Linux · 2 vim-enhanced 2:9.0.2153-1.amzn2.0.6
Amazon Linux · 2 vim-filesystem 2:9.0.2153-1.amzn2.0.6
Amazon Linux · 2 vim-minimal 2:9.0.2153-1.amzn2.0.6
Amazon Linux · 2 vim-X11 2:9.0.2153-1.amzn2.0.6
Amazon Linux · 2 xxd 2:9.0.2153-1.amzn2.0.6

Vulnerabilities 1

  • Medium 6.6
    CVE-2026-41411

    Vim: Command injection via backtick expansion in tag filenames

    Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment …

    vim vim vim vim Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-41411.html