Affected: AlmaLinux:9: vim-X11, AlmaLinux:9: vim-common, AlmaLinux:9: vim-enhanced, AlmaLinux:9: vim-filesystem, AlmaLinux:9: vim-minimal

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

* vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Alpaquita:23: vim, Alpaquita:25: vim, Alpaquita:stream: vim

Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.

Affected: openEuler:24.03-LTS-SP3: vim

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Security Fix(es):

Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.(CVE-2026-41411)

vim: arbitrary command execution via modeline sandbox bypass vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass vim: Command injection allows arbitrary code execution via malicious tag files vim: command injection when decompressing .tgz archives

vim: arbitrary command execution via modeline sandbox bypass vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass vim: Command injection allows arbitrary code execution via malicious tag files vim: command injection when decompressing .tgz archives

Affected: Rocky Linux:9: vim

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

* vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Ubuntu:Pro:14.04:LTS: vim, Ubuntu:Pro:16.04:LTS: vim, Ubuntu:Pro:18.04:LTS: vim, Ubuntu:Pro:20.04:LTS: vim, Ubuntu:22.04:LTS: vim, Ubuntu:24.04:LTS: vim, Ubuntu:25.10: vim, Ubuntu:26.04:LTS: vim

Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.

Ein Angreifer kann eine Schwachstelle in vim ausnutzen, um beliebigen Programmcode auszuführen.