Homepage

OS Command Injection The advisory has been revoked - it doesn't affect any version of package xxd  (opens in a new tab)

Threat Intelligence

EPSS
0.87% (59th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALMALINUX10-XXD-16081327
  • published16 Apr 2026
  • disclosed15 Apr 2026
Report a new vulnerability Found a mistake?

Introduced: 15 Apr 2026

CVE-2026-33412  (opens in a new tab)
CWE-78  (opens in a new tab)

Amendment

The AlmaLinux security team deemed this advisory irrelevant for AlmaLinux:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream xxd package and not the xxd package as distributed by AlmaLinux.

Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.