Medium severity5.6NVD Advisory· Published Mar 24, 2026· Updated Jul 15, 2026
CVE-2026-33412
CVE-2026-33412
Description
Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
36- osv-coords33 versionspkg:rpm/opensuse/vim&distro=openSUSE%20Tumbleweedpkg:rpm/suse/vim&distro=SUSE%20Linux%20Micro%206.0pkg:rpm/suse/vim&distro=SUSE%20Linux%20Micro%206.2pkg:rpm/almalinux/vim-X11pkg:rpm/almalinux/xxdpkg:rpm/opensuse/vim&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/vim-commonpkg:rpm/almalinux/vim-minimalpkg:rpm/almalinux/vim-enhancedpkg:rpm/almalinux/vim-filesystempkg:rpm/suse/vim&distro=SUSE%20Linux%20Micro%206.1pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Micro%205.3pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Micro%205.4pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Micro%205.2pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Micro%205.5pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5pkg:rpm/opensuse/vim&distro=openSUSE%20Leap%2015.6pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6pkg:rpm/almalinux/vim-data
< 9.2.0398-1.1+ 32 more
- (no CPE)range: < 9.2.0398-1.1
- (no CPE)range: < 9.2.0280-1.1
- (no CPE)range: < 9.2.0280-160000.1.1
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:9.1.083-6.el10_1.3
- (no CPE)range: < 9.2.0280-160000.1.1
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 9.2.0280-slfo.1.1_1.1
- (no CPE)range: < 9.2.0280-17.62.1
- (no CPE)range: < 9.2.0280-17.62.1
- (no CPE)range: < 9.2.0280-150000.5.89.1
- (no CPE)range: < 9.2.0280-150000.5.89.1
- (no CPE)range: < 9.2.0280-150000.5.89.1
- (no CPE)range: < 9.2.0280-150000.5.89.1
- (no CPE)range: < 9.2.0280-150000.5.89.1
- (no CPE)range: < 9.2.0280-150000.5.89.1
- (no CPE)range: < 9.2.0280-150000.5.89.1
- (no CPE)range: < 9.2.0280-160000.1.1
- (no CPE)range: < 9.2.0280-160000.1.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 2:9.1.083-6.el10_1.3
Patches
Vulnerability mechanics
References
37- www.openwall.com/lists/oss-security/2026/03/19/10nvdMailing ListPatchThird Party Advisory
- github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9anvdPatch
- github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46cnvdPatchVendor Advisory
- github.com/vim/vim/releases/tag/v9.2.0202nvdProduct
- access.redhat.com/errata/RHSA-2026:10065nvd
- access.redhat.com/errata/RHSA-2026:10097nvd
- access.redhat.com/errata/RHSA-2026:11768nvd
- access.redhat.com/errata/RHSA-2026:12274nvd
- access.redhat.com/errata/RHSA-2026:14773nvd
- access.redhat.com/errata/RHSA-2026:15087nvd
- access.redhat.com/errata/RHSA-2026:16008nvd
- access.redhat.com/errata/RHSA-2026:16009nvd
- access.redhat.com/errata/RHSA-2026:16174nvd
- access.redhat.com/errata/RHSA-2026:17596nvd
- access.redhat.com/errata/RHSA-2026:25096nvd
- access.redhat.com/errata/RHSA-2026:6502nvd
- access.redhat.com/errata/RHSA-2026:6539nvd
- access.redhat.com/errata/RHSA-2026:6540nvd
- access.redhat.com/errata/RHSA-2026:6617nvd
- access.redhat.com/errata/RHSA-2026:6619nvd
- access.redhat.com/errata/RHSA-2026:6620nvd
- access.redhat.com/errata/RHSA-2026:6725nvd
- access.redhat.com/errata/RHSA-2026:6729nvd
- access.redhat.com/errata/RHSA-2026:6730nvd
- access.redhat.com/errata/RHSA-2026:6731nvd
- access.redhat.com/errata/RHSA-2026:6736nvd
- access.redhat.com/errata/RHSA-2026:6915nvd
- access.redhat.com/errata/RHSA-2026:7239nvd
- access.redhat.com/errata/RHSA-2026:7243nvd
- access.redhat.com/errata/RHSA-2026:7335nvd
- access.redhat.com/errata/RHSA-2026:7711nvd
- access.redhat.com/errata/RHSA-2026:8259nvd
- access.redhat.com/errata/RHSA-2026:8423nvd
- access.redhat.com/errata/RHSA-2026:9832nvd
- access.redhat.com/security/cve/CVE-2026-33412nvd
- bugzilla.redhat.com/show_bug.cginvd
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33412.jsonnvd
News mentions
0No linked articles in our index yet.