CVE-2026-33412CWE-78

Vim affected by Command injection via newline in glob()

Medium · published March 24, 2026

CVSS v3.1
5.6
EPSS
1%
Percentile
61.4
In the wild
Unconfirmed
What it is

Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.

The record
Technical detail
CVSS v3.1
5.6 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00967 · 61.4th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-03-24T19:43Z
EPSS history
Timeline
  • 24 MAR 19:43Z
    Vim affected by Command injection via newline in glob()
    cvelistv5