Skip to content
OpenAdvisories
Medium RHSA-2026:28209 1 CVE

Red Hat Security Advisory: vim security update

Published Jun 24, 2026 · Updated Oct 9, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream vim-enhanced 2:8.2.2637-26.el9_8.6
Red Hat · RHEL 9 enterprise_linux:9::appstream vim-X11 2:8.2.2637-26.el9_8.6
Red Hat · RHEL 9 enterprise_linux:9::baseos vim 2:8.2.2637-26.el9_8.6
Red Hat · RHEL 9 enterprise_linux:9::baseos vim-minimal 2:8.2.2637-26.el9_8.6

Vulnerabilities 1

  • Medium 6.6
    CVE-2026-41411

    Vim: Command injection via backtick expansion in tag filenames

    Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment …

    vim vim vim vim Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461614
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28209.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-41411
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-41411
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-41411
  • article
    https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb
  • article
    https://github.com/vim/vim/releases/tag/v9.2.0357
  • article
    https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8