CVE-2026-41411

Katalog CVE

CVSS 6.6 · Medium EPSS 0,78%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada vim. Skor CVSS 3.1 6.6 (Medium) menurut github.com.

Deskripsi (NVD)

Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.

Rincian

Terbit di NVD

24 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.6 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

0,78% peluang dieksploitasi; lebih tinggi dari 54,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8 patch · advisory vendor
• https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb patch
• https://github.com/vim/vim/releases/tag/v9.2.0357 product