CVE-2026-33412

Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.(CVE-2026-33412)

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417)

• vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421)

• vim: Vim: Arbitrary code execution via command injection in glob() function (CVE-2026-33412)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417)

• vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421)

• vim: Vim: Arbitrary code execution via command injection in glob() function (CVE-2026-33412)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417)

• vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421)

• vim: Vim: Arbitrary code execution via command injection in glob() function (CVE-2026-33412)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-33412 in the vim package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-33412 in the vim package for Root:Debian:12. Multiple fixed versions available.

Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417)
• vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421)
• vim: Vim: Arbitrary code execution via command injection in glob() function (CVE-2026-33412)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417)
• vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421)
• vim: Vim: Arbitrary code execution via command injection in glob() function (CVE-2026-33412)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417)
• vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421)
• vim: Vim: Arbitrary code execution via command injection in glob() function (CVE-2026-33412)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.

• SECURITY UPDATE: Command injection via newline in glob()
  • debian/patches/CVE-2026-33412.patch: add '\n' to SHELL_SPECIAL in src/os_unix.c so newlines in glob() patterns are shell-escaped before mch_expand_wildcards() hands the string to the user's shell
  • CVE-2026-33412

• CVE-2026-33412: fix command injection via newline character in glob() on Unix-like systems by escaping '\n' in SHELL_SPECIAL

• SECURITY UPDATE: Command injection via newline in glob() on Unix-like systems
  • debian/patches/CVE-2026-33412.patch: add '\n' to the SHELL_SPECIAL macro in src/os_unix.c so mch_expand_wildcards() escapes embedded newlines before passing the glob pattern to the shell
  • CVE-2026-33412

• CVE-2026-33412: fix command injection via newline character in glob() on Unix-like systems by escaping '\n' in SHELL_SPECIAL

• CVE-2021-3796: fix use-after-free in nv_replace by getting the line pointer again after ins_copychar may have released it
• CVE-2021-3973: fix heap buffer overflow in find_file_in_path_option by rejecting len == 0 inputs
• CVE-2022-0413: fix use-after-free in do_sub when the substitute string is a "=" expression by copying the string before eval
• CVE-2022-0943: fix heap overflow in spell_suggest when "z=" in Visual mode by clamping badlen to the remaining line length
• CVE-2022-1620: fix NULL pointer access by guarding both vim_regexec calls in fname_match and the second fname_match call in buflist_match against rmp->regprog becoming NULL after the AUTOMATIC_ENGINE fallback fails to recompile the pattern
• CVE-2022-1796: fix use-after-free in find_pattern_in_path by making a copy of the identifier pointer before the call
• CVE-2022-2207: fix read-before-start-of-line in ins_bs by requiring w_cursor.col > 0 in the whitespace back-step loop
• CVE-2022-3235: fix use-after-free in cmdline input-method handling by tracking the owning buffer and checking buf_valid
• CVE-2022-3296: fix buffer underflow in ex_finally by searching for a valid CSF_TRY frame before accessing cs_flags
• CVE-2023-46246: fix integer overflow in :history by clamping long values to INT_MAX before casting to int
• CVE-2023-48231: fix use-after-free in win_close by returning early when the window is no longer valid after BufLeave
• CVE-2023-48706: fix use-after-free in ex_substitute by always allocating sub and freeing it on every exit path
• CVE-2026-33412: fix command injection via newline in glob() by adding '\n' to the SHELL_SPECIAL escape set

• CVE-2026-33412: fix OS command injection via newline in glob() by adding \n to SHELL_SPECIAL in src/os_unix.c so newlines are escaped before the pattern is passed to the user's shell

• CVE-2026-33412: fix OS command injection via newline in glob() by adding \n to SHELL_SPECIAL in src/os_unix.c so newlines are escaped before the pattern is passed to the user's shell

• SECURITY UPDATE: stack-based buffer overflow in option callback functions: illegal_char() and did_set_string_option() wrote the E539/E526/E535 option errors into the caller's 80-byte errbuf[] with unbounded sprintf(). The call site reported upstream, did_set_langmap() in src/map.c, does not exist in this version, where 'langmap' errors are reported through EMSG2() into a bounded buffer.
  • debian/patches/CVE-2024-22667.patch: introduce ERR_BUFLEN and use snprintf() bounded by it at the three sprintf() sites, in src/option.c and src/option.h; matches upstream patch 9.0.2142.
  • CVE-2024-22667
• SECURITY UPDATE: buffer overflow in 'helpfile' option handling: get_tagfname() copied the user-controlled 'helpfile' value into a MAXPATHL buffer with STRCPY() and then appended "tags" at the tail, so an over-long 'helpfile' overflowed the buffer.
  • debian/patches/CVE-2026-25749.patch: bound the copy with vim_strncpy() leaving room for the "tags" suffix, in src/tag.c; matches upstream patches 9.1.2132 and 9.1.2133.
  • CVE-2026-25749
• SECURITY UPDATE: buffer overflow in the netbeans specialKeys command: special_keys() walked the modifier prefix writing two bytes per modifier into the 64-byte keybuf[] with no bound, so a long modifier run overflowed it.
  • debian/patches/CVE-2026-26269.patch: stop the modifier loop while i + 2 < KEYBUFLEN, in src/netbeans.c; matches upstream patch 9.1.2148.
  • CVE-2026-26269
• SECURITY UPDATE: command injection via netrw URIs: the hostname and port taken from a netrw URI were interpolated unescaped into the command passed to system(), so shell metacharacters in the host or port ran arbitrary commands.
  • debian/patches/CVE-2026-28417.patch: validate the host against an RFC1123 hostname / IPv4 / IPv6 pattern at the four netrw entry points and shellescape() the host, user and port in s:MakeSshCmd(), in runtime/autoload/netrw.vim; matches upstream patches 9.2.0073, 9.2.0089 and 9.2.0553.
  • CVE-2026-28417
• SECURITY UPDATE: crash and huge allocation recovering a corrupted swap file: ml_recover() trusted pe_page_count, pe_bnum, pe_old_lnum and pe_line_count from the swap file, so bogus values caused a multi-GB mf_get() allocation or a SEGV inside readfile().
  • debian/patches/CVE-2026-28421.patch: bound pe_page_count and pe_bnum against mf_blocknr_max and validate pe_old_lnum and pe_line_count before use, in src/memline.c; matches upstream patch 9.2.0077.
  • CVE-2026-28421
• SECURITY UPDATE: command injection via newline in glob(): the newline character was missing from SHELL_SPECIAL, so it was not escaped before mch_expand_wildcards() handed the pattern to the shell and could act as a command separator.
  • debian/patches/CVE-2026-33412.patch: add '\n' to SHELL_SPECIAL, in src/os_unix.c; matches upstream patch 9.2.0202.
  • CVE-2026-33412
• SECURITY UPDATE: modeline security bypass: several options holding expressions could be set from a modeline, so opening a crafted file evaluated attacker-supplied expressions. In this version the expressions reachable this way are the 'statusline'-style %{} items of 'printheader' and 'guitabtooltip', which were evaluated in the sandbox only; the F{func} flag of 'complete' and the mapset() function named by the upstream advisory arrived in later releases and are not present in this version.
  • debian/patches/patch-8.1.1366-using-expressions-in-a-modeline-is-unsafe.patch: add the 'modelineexpr' option and the P_MLE flag, refuse P_MLE options in a modeline unless 'modelineexpr' is set, mark the expression-bearing options P_MLE, and document 'modelineexpr' and E992, in src/option.c, src/option.h and runtime/doc/options.txt; prerequisite…

Command injection via newline in glob() affects Vim < 9.2.0202. (CVE-2026-33412)

These are all security issues fixed in the gvim-9.2.0398-1.1 package on the GA media of openSUSE Tumbleweed.

This update for vim fixes the following issues:

• CVE-2026-33412: command injection via newline in glob() (bsc#1259985).
• CVE-2026-34714: crafted file can allow code execution (bsc#1261191).
• CVE-2026-34982: Vim modeline bypass via various options (bsc#1261271).

This update for vim fixes the following issues:

Update to version 9.2.0280.

• CVE-2026-34982: missing input validation allows for a modeline sandbox bypass and can lead to arbitrary OS command execution (bsc#1261271).
• CVE-2026-34714: missing checks allow for a tabpanel modeline escape and can lead to arbitrary OS command execution (bsc#1261191).
• CVE-2026-33412: improper escaping of newline characters allows for command injection in glob and can lead to arbitrary code execution (bsc#1259985).

This update for vim fixes the following issues:

Update to version 9.2.0280.

• CVE-2026-34982: missing input validation allows for a modeline sandbox bypass and can lead to arbitrary OS command execution (bsc#1261271).
• CVE-2026-34714: missing checks allow for a tabpanel modeline escape and can lead to arbitrary OS command execution (bsc#1261191).
• CVE-2026-33412: improper escaping of newline characters allows for command injection in glob and can lead to arbitrary code execution (bsc#1259985).

This update for vim fixes the following issues:

Update to version 9.2.0280.

• CVE-2026-34982: missing input validation allows for a modeline sandbox bypass and can lead to arbitrary OS command execution (bsc#1261271).
• CVE-2026-34714: missing checks allow for a tabpanel modeline escape and can lead to arbitrary OS command execution (bsc#1261191).
• CVE-2026-33412: improper escaping of newline characters allows for command injection in glob and can lead to arbitrary code execution (bsc#1259985).

This update for vim fixes the following issues:

• Update to 9.2.0280
• CVE-2026-33412: command injection via newline in glob() (bsc#1259985).
• CVE-2026-34714: crafted file can allow code execution (bsc#1261191).
• CVE-2026-34982: Vim modeline bypass via various options (bsc#1261271).

This update for vim fixes the following issues:

• Update to 9.2.0280
• CVE-2026-33412: command injection via newline in glob() (bsc#1259985).
• CVE-2026-34714: crafted file can allow code execution (bsc#1261191).
• CVE-2026-34982: Vim modeline bypass via various options (bsc#1261271).

This update for vim fixes the following issues:

• CVE-2026-33412: command injection via newline in glob() (bsc#1259985).
• CVE-2026-34714: crafted file can allow code execution (bsc#1261191).
• CVE-2026-34982: Vim modeline bypass via various options (bsc#1261271).

This update for vim fixes the following issues:

• CVE-2026-33412: command injection via newline in glob() (bsc#1259985).
• CVE-2026-34714: crafted file can allow code execution (bsc#1261191).
• CVE-2026-34982: Vim modeline bypass via various options (bsc#1261271).

This update for vim fixes the following issues:

• CVE-2026-33412: command injection via newline in glob() (bsc#1259985).
• CVE-2026-34714: crafted file can allow code execution (bsc#1261191).
• CVE-2026-34982: Vim modeline bypass via various options (bsc#1261271).