CVE-2026-41411

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41411", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-20T15:32:33.812Z", "datePublished": "2026-04-24T16:51:39.657Z", "dateUpdated": "2026-04-28T12:50:03.048Z"}, "containers": {"cna": {"title": "Vim: Command injection via backtick expansion in tag filenames", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8"}, {"name": "https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb", "tags": ["x_refsource_MISC"], "url": "https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb"}, {"name": "https://github.com/vim/vim/releases/tag/v9.2.0357", "tags": ["x_refsource_MISC"], "url": "https://github.com/vim/vim/releases/tag/v9.2.0357"}], "affected": [{"vendor": "vim", "product": "vim", "versions": [{"version": "< 9.2.0357", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T16:51:39.657Z"}, "descriptions": [{"lang": "en", "value": "Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user."}], "source": {"advisory": "GHSA-cwgx-gcj7-6qh8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-28T03:55:27.644754Z", "id": "CVE-2026-41411", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T12:50:03.048Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41411", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-20T15:32:33.812Z", "datePublished": "2026-04-24T16:51:39.657Z", "dateUpdated": "2026-04-28T12:50:03.048Z"}, "containers": {"cna": {"title": "Vim: Command injection via backtick expansion in tag filenames", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8"}, {"name": "https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb", "tags": ["x_refsource_MISC"], "url": "https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb"}, {"name": "https://github.com/vim/vim/releases/tag/v9.2.0357", "tags": ["x_refsource_MISC"], "url": "https://github.com/vim/vim/releases/tag/v9.2.0357"}], "affected": [{"vendor": "vim", "product": "vim", "versions": [{"version": "< 9.2.0357", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T16:51:39.657Z"}, "descriptions": [{"lang": "en", "value": "Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user."}], "source": {"advisory": "GHSA-cwgx-gcj7-6qh8", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41411", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-28T03:55:27.644754Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T17:44:01.881Z"}}]}}

{"affected": [{"affectedData": [{"product": "vim", "vendor": "vim", "versions": [{"status": "affected", "version": "< 9.2.0357"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*", "matchCriteriaId": "F35058AC-F23C-4B09-A352-664E4DA447F7", "versionEndExcluding": "9.2.0357", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user."}, {"lang": "es", "value": "Vim es un editor de texto de c\u00f3digo abierto y de l\u00ednea de comandos. Antes de la 9.2.0357, existe una vulnerabilidad de inyecci\u00f3n de comandos en el procesamiento de archivos de etiquetas de Vim. Al resolver una etiqueta, el campo de nombre de archivo del archivo de etiquetas se pasa a trav\u00e9s de la expansi\u00f3n de comodines para resolver variables de entorno y comodines. Si el campo de nombre de archivo contiene sintaxis de comillas invertidas (por ejemplo, \u2019comando\u2019), Vim ejecuta el comando incrustado a trav\u00e9s del shell del sistema con los privilegios completos del usuario en ejecuci\u00f3n."}], "id": "CVE-2026-41411", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41411", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-28T03:55:27.644754Z", "version": "2.0.3"}}]}, "published": "2026-04-24T17:16:22.037", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/vim/vim/releases/tag/v9.2.0357"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "vim: Vim: Command injection allows arbitrary code execution via malicious tag files", "id": "2461614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461614"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-78", "details": ["Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.", "A flaw was found in Vim, an open-source command-line text editor. This command injection vulnerability occurs during tag file processing. A local user could craft a malicious tags file containing backtick syntax in the filename field. When Vim resolves a tag from this file, it executes the embedded command via the system shell, leading to arbitrary code execution with the privileges of the running user."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue involves exercising caution when opening or processing tag files from untrusted sources. Users should avoid loading tag files from unknown or suspicious origins to prevent the execution of arbitrary commands."}, "name": "CVE-2026-41411", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-04-24T16:51:39Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-41411\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41411\nhttps://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb\nhttps://github.com/vim/vim/releases/tag/v9.2.0357\nhttps://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,9.2.0357)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "vim", "source": "cna", "vendor": "vim"}, "product": "vim", "vendor": "vim"}], "analysis": {"en": {"generated_at": "2026-04-28T13:41:01.969692+00:00", "value": {"mitigation_remediation": ["Upgrade Vim to version 9.2.0357 or later, which removes backtick handling from tag filenames.", "If an upgrade is not immediately possible, ensure that tags files are not writable by untrusted users and consider restricting the Vim environment using the 'secure' mode (set secure) to limit shell command execution.", "Regularly review and sanitize tags files in shared or multi\u2011user environments, and monitor for unexpected entries containing backticks."], "summary": {"action": "Apply Patch", "impact": "Local Command Execution"}, "threat_synthesis": {"affected_systems": "All installations of Vim supplied by the Vim project, specifically any releases before 9.2.0357. The vulnerability is exploitable on any system where a user has read access to a tags file they can influence or where a malicious tag file is introduced.\n", "description_and_impact": "Vim processes tag files used to navigate code. In versions prior to 9.2.0357, the filename field from a tag entry undergoes wildcard expansion, which allows backtick syntax (e.g., `command`) to be interpreted and executed by the underlying shell. This flaw falls under CWE\u201178 and results in arbitrary command execution with the privileges of the user running Vim.", "risk_and_exploitability": "The CVSS score of 6.6 indicates moderate severity. The EPSS score (<1%) suggests low current exploitation probability, and the vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires local access and the ability to craft or modify a tags file; it does not provide network\u2011level intrusion. Given its local execution nature, the risk is confined to the privileges of the Vim user. Potential attackers could gain confidentiality, integrity, or availability by running arbitrary commands on the host."}}}}, "created": "2026-04-27T21:45:14.289804+00:00", "updated": "2026-04-28T13:45:06.142125+00:00", "vendors": ["vim", "vim$PRODUCT$vim"]}