Homepage

OS Command Injection The advisory has been revoked - it doesn't affect any version of package vim-common  (opens in a new tab)

Threat Intelligence

EPSS
0.87% (59th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALMALINUX10-VIMCOMMON-16081322
  • published16 Apr 2026
  • disclosed15 Apr 2026
Report a new vulnerability Found a mistake?

Introduced: 15 Apr 2026

CVE-2026-33412  (opens in a new tab)
CWE-78  (opens in a new tab)

Amendment

The AlmaLinux security team deemed this advisory irrelevant for AlmaLinux:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-common package and not the vim-common package as distributed by AlmaLinux.

Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.