Command Injection Vulnerability in Vim Package - CVE-2026-33412
Summary
ALPINE-CVE-2026-33412: Vim is an open source, command line text editor. Affects vim versions < 9.2.0219-r0. Fixed in 9.2.0219-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a widely-used open-source command line text editor known for its efficiency and versatility in text manipulation. It supports various programming languages and offers features like syntax highlighting, multi-level undo, and extensive plugin support. However, prior to version 9.2.0202, Vim is vulnerable to a command injection issue in its glob() function on Unix-like systems, which can be exploited if certain conditions are met.
Vulnerability Detail
The vulnerability arises from the way Vim handles patterns passed to its glob() function. By including a newline character (\n) in the pattern, an attacker can potentially execute arbitrary shell commands. This issue is contingent upon the user's 'shell' setting, making it a significant risk for users who may inadvertently expose their systems to command execution vulnerabilities. The ramifications of this vulnerability could lead to unauthorized access or control over the affected system, depending on the commands executed.
How To Fix
Minimum fixed version
9.2.0219-r0
This is the first release that contains the fix.
sudo apk add --upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using patterns with newline characters in the glob() function until they can update to the patched version. Additionally, reviewing and adjusting the 'shell' setting in Vim may help mitigate the risk.
Conclusion
The command injection vulnerability in Vim (CVE-2026-33412) poses a significant risk to users of the text editor prior to version 9.2.0202. It is crucial for users to update their software to the patched version to mitigate potential security threats. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for vim →
FAQ
CVE-2026-33412 is a command injection vulnerability found in the Vim text editor that allows attackers to execute arbitrary shell commands by manipulating the glob() function.
You can check your Vim version by running 'vim --version' in the terminal. If it is below 9.2.0202, it is vulnerable.
If exploited, this vulnerability could allow an attacker to execute arbitrary commands on the affected system, potentially leading to unauthorized access or control.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
More information can be found on the official CVE database or by visiting Vulert's playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for vim.
