Unrated severityNVD Advisory· Published Mar 24, 2026· Updated Mar 26, 2026
Vim affected by Command injection via newline in glob()
CVE-2026-33412
Description
Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
35- osv-coords33 versionspkg:rpm/almalinux/vim-commonpkg:rpm/almalinux/vim-datapkg:rpm/almalinux/vim-enhancedpkg:rpm/almalinux/vim-filesystempkg:rpm/almalinux/vim-minimalpkg:rpm/almalinux/vim-X11pkg:rpm/almalinux/xxdpkg:rpm/opensuse/vim&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/vim&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/vim&distro=openSUSE%20Tumbleweedpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Micro%205.2pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Micro%205.3pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Micro%205.4pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Micro%205.5pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5pkg:rpm/suse/vim&distro=SUSE%20Linux%20Micro%206.0pkg:rpm/suse/vim&distro=SUSE%20Linux%20Micro%206.1pkg:rpm/suse/vim&distro=SUSE%20Linux%20Micro%206.2
< 2:8.0.1763-22.el8_10.1+ 32 more
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:9.1.083-6.el10_1.3
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:9.1.083-6.el10_1.3
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-160000.1.1
- (no CPE)range: < 9.2.0398-1.1
- (no CPE)range: < 9.2.0280-150000.5.89.1
- (no CPE)range: < 9.2.0280-150000.5.89.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-150000.5.89.1
- (no CPE)range: < 9.2.0280-150000.5.89.1
- (no CPE)range: < 9.2.0280-150000.5.89.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-17.62.1
- (no CPE)range: < 9.2.0280-150000.5.89.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-160000.1.1
- (no CPE)range: < 9.2.0280-150000.5.89.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-150500.20.46.1
- (no CPE)range: < 9.2.0280-160000.1.1
- (no CPE)range: < 9.2.0280-17.62.1
- (no CPE)range: < 9.2.0280-1.1
- (no CPE)range: < 9.2.0280-slfo.1.1_1.1
- (no CPE)range: < 9.2.0280-160000.1.1
Patches
Vulnerability mechanics
References
3- github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9amitrex_refsource_MISC
- github.com/vim/vim/releases/tag/v9.2.0202mitrex_refsource_MISC
- github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46cmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.