Critical Vulnerability in Vim: Arbitrary Code Execution and Denial of Service Risks
Summary
RLSA-2026:7711: Important: vim security update. Affects vim versions < 2:9.1.083-6.el10_1.3. Fixed in 2:9.1.083-6.el10_1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim, or Vi IMproved, is a highly configurable text editor built to enable efficient text editing. It is widely used in programming and system administration due to its powerful features, including syntax highlighting, multi-level undo, and a robust plugin system. However, recent vulnerabilities have been identified that could allow attackers to execute arbitrary code or cause denial of service through specific plugins and functions.
Vulnerability Detail
The vulnerabilities in Vim stem from issues in the netrw plugin and the glob() function. Specifically, CVE-2026-28417 allows for arbitrary code execution via OS command injection in the netrw plugin, while CVE-2026-28421 can lead to denial of service and information disclosure through crafted swap files. Additionally, CVE-2026-33412 also permits arbitrary code execution through command injection in the glob() function. These vulnerabilities could be exploited by an attacker to execute malicious commands or disrupt service, posing significant risks to users.
How To Fix
Minimum fixed version
2:9.1.083-6.el10_1.3
This is the first release that contains the fix.
sudo dnf update vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the netrw plugin and avoid using the glob() function until the update is applied. This can be done by commenting out the relevant lines in the Vim configuration file or by not invoking these features during editing sessions.
Conclusion
In summary, the identified vulnerabilities in Vim present significant risks, including arbitrary code execution and denial of service. Users are strongly advised to update to the latest patched version to mitigate these risks. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities in open-source software effectively.
See every vulnerability recorded for vim →
FAQ
The CVSS score of the vulnerability is 7.3, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerabilities could lead to arbitrary code execution, allowing attackers to run malicious commands, or cause denial of service, disrupting normal operations.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If an immediate update is not possible, consider disabling the netrw plugin and avoiding the use of the glob() function as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for vim.
