Skip to content
OpenAdvisories
Medium · 6.6 CVE-2026-41411 EUVD-2026-25575

Vim: Command injection via backtick expansion in tag filenames

Published Apr 24, 2026 · Updated Apr 28, 2026 · Assigned by GitHub_M

Vendor: vim Product: vim Package: vim Package: vim Package: vim Package: vim Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.

Affected products

VendorProductAffectedFixed
vim vim < 9.2.0357 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 vim 2:9.2.0428-1 —
Debian 13 vim 2:9.1.1230-2+deb13u1 —
Debian 12 vim No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS vim 2:9.1.2141-1ubuntu4.1 —
Ubuntu 25.10 vim 2:9.1.0967-1ubuntu6.4 —
Ubuntu 24.04 LTS vim 2:9.1.0016-1ubuntu7.13 —
Ubuntu 22.04 LTS vim 2:8.2.3995-1ubuntu2.29 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS vim 2:8.1.2269-1ubuntu5.32+esm6 USN-8342-1
Ubuntu Pro 18.04 LTS vim 2:8.0.1453-1ubuntu1.13+esm18 USN-8342-1
Ubuntu Pro 16.04 LTS vim 2:7.4.1689-3ubuntu1.5+esm33 USN-8342-1
Ubuntu Pro 14.04 LTS vim 2:7.4.052-1ubuntu3.1+esm27 USN-8342-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 vim +3 2:9.1.083-9.el10_2.4 RHSA-2026:28210
RHEL 9 vim +3 2:8.2.2637-26.el9_8.6 RHSA-2026:28209
RHEL 8 vim +3 2:8.0.1763-24.el8_10 RHSA-2026:28553
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS vim +7 2:9.1.083-5.el10_0.3 RHSA-2026:30900
RHEL 9.6 EUS vim +5 2:8.2.2637-22.el9_6.3 RHSA-2026:28050
RHEL 9.4 E4S vim +5 2:8.2.2637-20.el9_4.3 RHSA-2026:28049
RHEL 9.2 E4S vim +5 2:8.2.2637-20.el9_2.2 RHSA-2026:28133
RHEL 8.8 TUS vim +5 2:8.0.1763-20.el8_8.2 RHSA-2026:34476
RHEL 8.8 E4S vim +5 2:8.0.1763-20.el8_8.2 RHSA-2026:34476
RHEL 8.6 EUS Long Life vim +5 2:8.0.1763-19.el8_6.6 RHSA-2026:34477
RHEL 8.6 AUS vim +5 2:8.0.1763-19.el8_6.6 RHSA-2026:34477
RHEL 8.4 EUS Long Life vim +5 2:8.0.1763-15.el8_4.2 RHSA-2026:33453
RHEL 8.4 AUS vim +5 2:8.0.1763-15.el8_4.2 RHSA-2026:33453
RHEL 7 ELS vim +4 2:7.4.629-8.el7_9.2 RHSA-2026:68711
RHEL 6 ELS vim +4 2:7.4.629-5.el6_10.4 RHSA-2026:69128
Red Hat Hardened Images 1 vim +8 2:9.2.967-1.1.hum1 RHSA-2026:57614

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 xxd +6 2:9.1.083-9.el10_2.4 ALSA-2026:28210
AlmaLinux 9 vim-X11 +4 2:8.2.2637-26.el9_8.6 ALSA-2026:28209
AlmaLinux 8 vim-X11 +4 2:8.0.1763-24.el8_10 ALSA-2026:28553

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 vim 2:9.1.083-9.el10_2.4 RLSA-2026:28210
Rocky Linux 9 vim 2:8.2.2637-26.el9_8.6 RLSA-2026:28209
Rocky Linux 8 vim 2:8.0.1763-24.el8_10 RLSA-2026:28553

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 vim 9.2.0357-r0 —
Alpine v3.23 vim 9.2.0357-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 xxd +6 2:9.2.240-1.amzn2023.0.3 ALAS2023-2026-1667
Amazon Linux 2 xxd +6 2:9.0.2153-1.amzn2.0.6 ALAS2-2026-3292

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 vim 9.2.0392-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 xxd +6 2:9.1.083-9.0.1.el10_2.7 ELSA-2026-28210
Oracle Linux 9 vim-X11 +4 2:8.2.2637-26.0.1.el9_8.6 ELSA-2026-28209
Oracle Linux 8 vim-X11 +4 2:8.0.1763-24.0.1.el8_10 ELSA-2026-28553

Advisories 27

References