Executive brief
Vim is a widely used open-source text editor. A security vulnerability in its 'tar' plugin allows for command execution when a user interacts with a specially crafted archive file. If a user opens a .tgz archive with a malicious filename and runs a specific decompression command, an attacker could execute arbitrary shell commands with the user's permissions.
Technical details
A command injection vulnerability exists in the tar#Vimuntar() function within Vim's tar plugin (runtime/autoload/tar.vim). The root cause is the improper use of the shellescape() function when constructing shell commands for gunzip/gzip. Specifically, the function omits the required second argument (the {special} flag) when building ':!' commands. This omission allows Vim to re-expand cmdline-special characters (such as %, #, and !) within a filename before passing it to the system shell. An attacker can exploit this by providing a .tgz archive with a filename containing both single quotes and Vim special characters. If a victim opens this file and executes the :Vimuntar command, the attacker can break out of the shell escaping and execute arbitrary commands in the user's context. The issue is fixed in version 9.2.0479.
Affected products
- Vim Vim < 9.2.0479
Timeline
- 2026-05-14: patched: Vim patch v9.2.0479 released.
- 2026-05-15: advisory: NVD published CVE-2026-46483.