What’s Vulnerable › Vulnerabilities

CVE-2026-41411: Vim: Command injection via backtick expansion in tag filenames

• Severity: medium (CVSS 6.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-24 · updated 2026-06-17
• Weakness: CWE-78

Description

Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.

Affected products

• vim/vim: before 9.2.0357 — fixed in 9.2.0357

How to fix

Upgrade to a fixed version: vim/vim 9.2.0357. Check the vendor advisory for mitigations.

References

• https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb
• https://github.com/vim/vim/releases/tag/v9.2.0357
• https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8

Get alerted when CVE-2026-41411 or the next vulnerability affects your stack