Unrated severityNVD Advisory· Published Mar 24, 2026· Updated Mar 26, 2026
Vim affected by Command injection via newline in glob()
CVE-2026-33412
Description
Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.
Affected products
2Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9amitrex_refsource_MISC
- github.com/vim/vim/releases/tag/v9.2.0202mitrex_refsource_MISC
- github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46cmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.