CVE-2026-46483 — Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag

Description

Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in
runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479.

Affected products

Vendor	Product	Affected	Fixed
vim	vim	< 9.2.479	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	vim	2:9.2.0524-1	—
Debian 13	vim	2:9.1.1230-2+deb13u1	—
Debian 12	vim	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.04 LTS	vim	2:9.1.2141-1ubuntu4.3	—
Ubuntu 25.10	vim	2:9.1.0967-1ubuntu6.6	—
Ubuntu 24.04 LTS	vim	2:9.1.0016-1ubuntu7.15	—
Ubuntu 22.04 LTS	vim	2:8.2.3995-1ubuntu2.31	—

Show 4 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 20.04 LTS	vim	2:8.1.2269-1ubuntu5.32+esm7	—
Ubuntu Pro 18.04 LTS	vim	2:8.0.1453-1ubuntu1.13+esm19	—
Ubuntu Pro 16.04 LTS	vim	2:7.4.1689-3ubuntu1.5+esm34	—
Ubuntu Pro 14.04 LTS	vim	2:7.4.052-1ubuntu3.1+esm28	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	vim +1	2:9.1.083-9.el10_2.7	RHSA-2026:38509
RHEL 9	vim +1	2:8.2.2637-26.el9_8.10	RHSA-2026:38511
RHEL 8	vim +1	2:8.0.1763-27.el8_10	RHSA-2026:38510

Show 13 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 10.0 EUS	vim +7	2:9.1.083-5.el10_0.3	RHSA-2026:30900
RHEL 9.6 EUS	vim +5	2:8.2.2637-22.el9_6.3	RHSA-2026:28050
RHEL 9.4 E4S	vim +5	2:8.2.2637-20.el9_4.3	RHSA-2026:28049
RHEL 9.2 E4S	vim +5	2:8.2.2637-20.el9_2.2	RHSA-2026:28133
RHEL 8.8 TUS	vim +5	2:8.0.1763-20.el8_8.2	RHSA-2026:34476
RHEL 8.8 E4S	vim +5	2:8.0.1763-20.el8_8.2	RHSA-2026:34476
RHEL 8.6 EUS Long Life	vim +5	2:8.0.1763-19.el8_6.6	RHSA-2026:34477
RHEL 8.6 AUS	vim +5	2:8.0.1763-19.el8_6.6	RHSA-2026:34477
RHEL 8.4 EUS Long Life	vim +5	2:8.0.1763-15.el8_4.2	RHSA-2026:33453
RHEL 8.4 AUS	vim +5	2:8.0.1763-15.el8_4.2	RHSA-2026:33453
RHEL 7 ELS	vim +4	2:7.4.629-8.el7_9.2	RHSA-2026:68711
RHEL 6 ELS	vim +4	2:7.4.629-5.el6_10.4	RHSA-2026:69128
Red Hat Hardened Images 1	vim +8	9.2.967-1.1.hum1	RHSA-2026:57614

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 10	xxd +6	2:9.1.083-9.el10_2.7	ALSA-2026:38509
AlmaLinux 9	vim-X11 +4	2:8.2.2637-26.el9_8.10	ALSA-2026:38511
AlmaLinux 8	vim-X11 +4	2:8.0.1763-27.el8_10	ALSA-2026:38510

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 10	vim	2:9.1.083-9.el10_2.7	RLSA-2026:38509
Rocky Linux 9	vim	2:8.2.2637-26.el9_8.10	RLSA-2026:38511
Rocky Linux 8	vim	2:8.0.1763-27.el8_10	RLSA-2026:38510

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP4	vim	9.2.0530-150000.5.94.1	SUSE-SU-2026:2313-1

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15 SP4	vim	9.2.0530-150000.5.94.1	SUSE-SU-2026:2313-1
SLE Micro 6.2	vim	9.2.0530-160000.1.1	SUSE-SU-2026:21833-1
SLE Micro 5.4	vim	9.2.0530-150000.5.94.1	SUSE-SU-2026:2313-1
SLE Micro 5.3	vim	9.2.0530-150000.5.94.1	SUSE-SU-2026:2313-1
SLE HPC 15 SP4	vim	9.2.0530-150000.5.94.1	SUSE-SU-2026:2313-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	vim	9.2.0530-1.1	openSUSE-SU-2026:11114-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	vim	9.2.0481-r0	—
Alpine v3.23	vim	9.2.0481-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	xxd +6	2:9.2.597-1.amzn2023.0.1	ALAS2023-2026-1862

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	vim	9.2.0488-1	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 10	xxd +6	2:9.1.083-9.0.1.el10_2.7	ELSA-2026-38509
Oracle Linux 9	vim-X11 +4	2:8.2.2637-26.0.1.el9_8.10	ELSA-2026-38511
Oracle Linux 8	vim-X11 +4	2:8.0.1763-27.0.1.el8_10	ELSA-2026-38510

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	vim +1	9.2.0480-r0	—

Advisories 27

WID-SEC-2026-1548 vim: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Nov 11, 2026
ALSA-2026:38509 Important: vim security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:38511 Important: vim security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:38510 Important: vim security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2026:69128 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2026:57614 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2026:68711 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2026:38511 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2026:38510 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2026:38509 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2026:34477 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
RHSA-2026:34476 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
RHSA-2026:33453 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
RHSA-2026:30900 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
RHSA-2026:28133 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
RHSA-2026:28050 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
RHSA-2026:28049 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
RLSA-2026:38509 Important: vim security update Rocky Linux Security Advisories · Aug 11, 2026
RLSA-2026:38510 Important: vim security update Rocky Linux Security Advisories · Aug 11, 2026
RLSA-2026:38511 Important: vim security update Rocky Linux Security Advisories · Aug 11, 2026
ELSA-2026-38509 Important: vim security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
ELSA-2026-38511 Important: vim security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 14, 2026
ELSA-2026-38510 Important: vim security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 13, 2026
SUSE-SU-2026:21833-1 Security update for vim SUSE / openSUSE Security Updates · Jul 9, 2026
openSUSE-SU-2026:11114-1 gvim-9.2.0530-1.1 on GA media SUSE / openSUSE Security Updates · Jun 24, 2026
ALAS2023-2026-1862 Important: vim security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 22, 2026
SUSE-SU-2026:2313-1 Security update for vim SUSE / openSUSE Security Updates · Jun 10, 2026

CNA	v3.1	3.6
EUVD	v3.1	3.6

Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Azure Linux

Oracle Linux

Wolfi

Advisories 27

References