CVE-2026-41411

MediumCVSS 6.6/10Last modified Nov 11, 2026

Description

Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
vim	vim	< 9.2.0357

References

https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fbPatch
https://github.com/vim/vim/releases/tag/v9.2.0357Product
https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8Patch, Vendor Advisory

Timeline

Published: Apr 24, 2026
Last modified: Nov 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-414124.9alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, the a CVE-2026-414137.7Istio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a RequestAuthentication re CVE-2026-414147.4Skim is a fuzzy finder designed to through files, lines, and commands. The generate-files job in .github/workflows/pr.yml checks out attacke CVE-2026-414159.1PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an out-of-bounds read when pars CVE-2026-414167.5PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an integer overflow in media st CVE-2026-414175.3Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is CVE-2026-414185.34ga Boards is a boards system for realtime project management. Prior to 3.3.5, 4ga Boards is vulnerable to user enumeration via a timing sid CVE-2026-414197.64ga Boards is a boards system for realtime project management. Prior to 3.3.5, a path traversal vulnerability allows an authenticated user w CVE-2026-41424.4The Sentence To SEO (keywords, description and tags) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Permanent ke CVE-2026-414218.8SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, SiYuan desktop renders notification messages as raw HTML insi CVE-2026-414228.3Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parame CVE-2026-414235.3Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to