Skip to content
OpenAdvisories
High RLSA-2026:38511 4 CVEs

Important: vim security update

Published Aug 11, 2026 · Updated Aug 11, 2026

Ecosystem: Rocky Linux

Summary

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

* vim: command injection when decompressing .tgz archives (CVE-2026-46483)

* vim: Vim: Arbitrary Code Execution via crafted directory names (CVE-2026-47162)

* vim: Vim: Arbitrary code execution via Python omni-completion (CVE-2026-52858)

* vim: Vim: Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 9 vim 2:8.2.2637-26.el9_8.10

Vulnerabilities 4

  • High 7.3
    CVE-2026-47162

    Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name

    Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths …

    vim vim vim vim Debian Ubuntu Azure Linux
  • High 7.3
    CVE-2026-52858

    Vim: Arbitrary Code Execution via Python Omni-Completion

    Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) exec…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 5.1
    CVE-2026-47167

    Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex

    Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with +ruby support. Step-definition patterns read …

    vim vim vim vim Debian Ubuntu Azure Linux
  • Low 3.6
    CVE-2026-46483

    Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag

    Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d comman…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477915
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2487964
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2487981
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2487996