CVE-2026-46483CWE-78CWE-88

Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag

Low · published May 15, 2026

CVSS v3.1
3.6
EPSS
1%
Percentile
53.1
In the wild
Unconfirmed
What it is

Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in

runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479.

The record
Technical detail
CVSS v3.1
3.6 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00713 · 53.1th percentile
Weaknesses
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'); CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2026-05-15T14:57Z
EPSS history
Timeline
  • 15 MAY 14:57Z
    Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag
    cvelistv5