CVE-2026-33412mediumCWE-78

Vim affected by Command injection via newline in glob()

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.6epss 0.8%

probabilidade de exploração

0.8%top 44% das CVEs

exploração observada

nãonenhuma fonte reporta

Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

Produtos afetados

vim · vim

Referências