Critical Security Flaw in Vim Packages: Command Injection and Code Execution Vulnerabilities
Summary
ALSA-2026:38509: Important: vim security update. Affects vim-X11 versions < 2:9.1.083-9.el10_2.7. Fixed in 2:9.1.083-9.el10_2.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim (Vi IMproved) is a highly popular text editor known for its efficiency and extensibility. It is widely used in various environments for programming and text editing. The affected packages include vim-X11, vim-common, vim-data, vim-enhanced, vim-filesystem, vim-minimal, and xxd, all part of the AlmaLinux ecosystem. These packages provide essential functionalities for users, but they have been found vulnerable to several security issues that could allow attackers to execute arbitrary code.
Vulnerability Detail
The vulnerabilities stem from multiple issues within Vim that can lead to command injection and arbitrary code execution. Specifically, the vulnerabilities include: 1) Command injection when decompressing .tgz archives (CVE-2026-46483), 2) Arbitrary code execution via crafted directory names (CVE-2026-47162), 3) Arbitrary code execution via Python omni-completion (CVE-2026-52858), and 4) Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167). These vulnerabilities can be exploited by attackers to execute malicious code, potentially compromising the integrity and security of the system.
How To Fix
Minimum fixed version
2:9.1.083-9.el10_2.7
This is the first release that contains the fix.
sudo dnf update vim-X11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected features of Vim until the packages are updated. This includes refraining from decompressing .tgz archives and avoiding the use of Python omni-completion and crafted directory names in Vim.
Conclusion
The recent security vulnerabilities discovered in Vim packages pose significant risks to users. It is crucial to update to the patched versions to safeguard against potential exploits. Users are encouraged to monitor their software for vulnerabilities using tools like Vulert.
See every vulnerability recorded for vim-X11 →
FAQ
Vim is a highly configurable text editor built to enable efficient text editing and programming.
The vulnerabilities include command injection and arbitrary code execution via various methods, including crafted directory names and Python omni-completion.
You can check your Vim version by running 'vim --version' in the terminal. If it is below 2:9.1.083-9.el10_2.7, it is vulnerable.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for vim-X11.
