Skip to content
OpenAdvisories
High ALAS2023-2026-1667 1 CVE

Important: vim security update (Amazon Linux 2023)

Published May 11, 2026 · Updated May 13, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-41411: Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.

Fixed packages 12

ReleasePackageFixed in
Amazon Linux · 2023 vim-common 2:9.2.240-1.amzn2023.0.3
Amazon Linux · 2023 vim-data 2:9.2.240-1.amzn2023.0.3
Amazon Linux · 2023 vim-debuginfo 2:9.2.240-1.amzn2023.0.3
Amazon Linux · 2023 vim-debugsource 2:9.2.240-1.amzn2023.0.3
Amazon Linux · 2023 vim-default-editor 2:9.2.240-1.amzn2023.0.3
Amazon Linux · 2023 vim-enhanced 2:9.2.240-1.amzn2023.0.3
Amazon Linux · 2023 vim-enhanced-debuginfo 2:9.2.240-1.amzn2023.0.3
Amazon Linux · 2023 vim-filesystem 2:9.2.240-1.amzn2023.0.3
Amazon Linux · 2023 vim-minimal 2:9.2.240-1.amzn2023.0.3
Amazon Linux · 2023 vim-minimal-debuginfo 2:9.2.240-1.amzn2023.0.3
Amazon Linux · 2023 xxd 2:9.2.240-1.amzn2023.0.3
Amazon Linux · 2023 xxd-debuginfo 2:9.2.240-1.amzn2023.0.3

Vulnerabilities 1

  • Medium 6.6
    CVE-2026-41411

    Vim: Command injection via backtick expansion in tag filenames

    Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment …

    vim vim vim vim Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-41411.html