Junglewise Threat Intelligence

CVE-2026-33412: Vim command injection in glob function via newline character

CVE-2026-33412 · Severity: medium · CVSS 5.6 · Published 2026-03-24

Technologies: Vim. Vendors: Vim.

Executive brief

Vim is a widely used open-source text editor for Unix-like systems. A security flaw in its file-searching function allows a malicious pattern to execute unauthorized commands on the user's computer. This could lead to an attacker gaining control over the user's files or system if they can trick a Vim plugin or script into processing a specially crafted search term.

Technical details

A command injection vulnerability exists in Vim's glob() function and other features performing wildcard expansion on Unix-like systems. The root cause is the failure to include the newline character (\n) in the SHELL_SPECIAL list of characters to be escaped before being passed to mch_expand_wildcards(). When a pattern containing a newline is processed, the shell interprets the newline as a command separator, executing subsequent characters as arbitrary shell commands. Exploitation typically requires a VimScript plugin to pass untrusted user input into the glob() function. The vulnerability's effectiveness depends on the user's 'shell' configuration. This issue is fixed in version 9.2.0202.

Affected products

  • Vim Vim < 9.2.0202

Timeline

  • 2026-03-19: patched: Vim patch v9.2.0202 released
  • 2026-03-19: advisory: GitHub Advisory GHSA-w5jw-f54h-x46c published
  • 2026-03-24: disclosed: CVE-2026-33412 published to NVD

References

Related threats