Skip to content
OpenAdvisories
Medium USN-8342-1 1 CVE

vim vulnerability

Published May 28, 2026 · Updated May 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Vim did not properly handle backticks in tag
filenames. An attacker could possibly use this issue to execute
arbitrary commands.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS vim 2:7.4.052-1ubuntu3.1+esm27
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS vim 2:7.4.1689-3ubuntu1.5+esm33
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS vim 2:8.0.1453-1ubuntu1.13+esm18
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS vim 2:8.1.2269-1ubuntu5.32+esm6

Vulnerabilities 1

  • Medium 6.6
    CVE-2026-41411

    Vim: Command injection via backtick expansion in tag filenames

    Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment …

    vim vim vim vim Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2026-41411