Vulnerability-Lookup

SUSE-SU-2026:21118-1

Vulnerability from csaf_suse - Published: 2026-04-14 08:33 - Updated: 2026-04-14 08:33

Summary

Security update for vim

Severity

Important

Notes

Title of the patch: Security update for vim

Description of the patch: This update for vim fixes the following issues: - Update to 9.2.0280 - CVE-2026-33412: command injection via newline in glob() (bsc#1259985). - CVE-2026-34714: crafted file can allow code execution (bsc#1261191). - CVE-2026-34982: Vim modeline bypass via various options (bsc#1261271).

Patchnames: SUSE-SLE-Micro-6.1-486

CVE-2026-33412

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2026-34714

8.6 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2026-34982

8.2 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

References

URL

Category

	https://www.suse.com/support/security/rating/	external
	https://ftp.suse.com/pub/projects/security/csaf/s…	self
	https://www.suse.com/support/update/announcement/…	self
	https://lists.suse.com/pipermail/sle-security-upd…	self
	https://bugzilla.suse.com/1259985	self
	https://bugzilla.suse.com/1261191	self
	https://bugzilla.suse.com/1261271	self
	https://www.suse.com/security/cve/CVE-2026-33412/	self
	https://www.suse.com/security/cve/CVE-2026-34714/	self
	https://www.suse.com/security/cve/CVE-2026-34982/	self
	https://www.suse.com/security/cve/CVE-2026-33412	external
	https://bugzilla.suse.com/1259985	external
	https://www.suse.com/security/cve/CVE-2026-34714	external
	https://bugzilla.suse.com/1261191	external
	https://www.suse.com/security/cve/CVE-2026-34982	external
	https://bugzilla.suse.com/1261271	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for vim",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for vim fixes the following issues:\n\n- Update to 9.2.0280\n- CVE-2026-33412: command injection via newline in glob() (bsc#1259985).\n- CVE-2026-34714: crafted file can allow code execution (bsc#1261191).\n- CVE-2026-34982: Vim modeline bypass via various options (bsc#1261271).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.1-486",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_21118-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:21118-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202621118-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:21118-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-April/025425.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1259985",
        "url": "https://bugzilla.suse.com/1259985"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261191",
        "url": "https://bugzilla.suse.com/1261191"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261271",
        "url": "https://bugzilla.suse.com/1261271"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33412 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33412/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34714 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34714/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34982 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34982/"
      }
    ],
    "title": "Security update for vim",
    "tracking": {
      "current_release_date": "2026-04-14T08:33:54Z",
      "generator": {
        "date": "2026-04-14T08:33:54Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:21118-1",
      "initial_release_date": "2026-04-14T08:33:54Z",
      "revision_history": [
        {
          "date": "2026-04-14T08:33:54Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-small-9.2.0280-slfo.1.1_1.1.aarch64",
                "product": {
                  "name": "vim-small-9.2.0280-slfo.1.1_1.1.aarch64",
                  "product_id": "vim-small-9.2.0280-slfo.1.1_1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-data-common-9.2.0280-slfo.1.1_1.1.noarch",
                "product": {
                  "name": "vim-data-common-9.2.0280-slfo.1.1_1.1.noarch",
                  "product_id": "vim-data-common-9.2.0280-slfo.1.1_1.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-small-9.2.0280-slfo.1.1_1.1.ppc64le",
                "product": {
                  "name": "vim-small-9.2.0280-slfo.1.1_1.1.ppc64le",
                  "product_id": "vim-small-9.2.0280-slfo.1.1_1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-small-9.2.0280-slfo.1.1_1.1.s390x",
                "product": {
                  "name": "vim-small-9.2.0280-slfo.1.1_1.1.s390x",
                  "product_id": "vim-small-9.2.0280-slfo.1.1_1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-small-9.2.0280-slfo.1.1_1.1.x86_64",
                "product": {
                  "name": "vim-small-9.2.0280-slfo.1.1_1.1.x86_64",
                  "product_id": "vim-small-9.2.0280-slfo.1.1_1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.1",
                "product": {
                  "name": "SUSE Linux Micro 6.1",
                  "product_id": "SUSE Linux Micro 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-data-common-9.2.0280-slfo.1.1_1.1.noarch as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:vim-data-common-9.2.0280-slfo.1.1_1.1.noarch"
        },
        "product_reference": "vim-data-common-9.2.0280-slfo.1.1_1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-small-9.2.0280-slfo.1.1_1.1.aarch64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.aarch64"
        },
        "product_reference": "vim-small-9.2.0280-slfo.1.1_1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-small-9.2.0280-slfo.1.1_1.1.ppc64le as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.ppc64le"
        },
        "product_reference": "vim-small-9.2.0280-slfo.1.1_1.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-small-9.2.0280-slfo.1.1_1.1.s390x as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.s390x"
        },
        "product_reference": "vim-small-9.2.0280-slfo.1.1_1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-small-9.2.0280-slfo.1.1_1.1.x86_64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.x86_64"
        },
        "product_reference": "vim-small-9.2.0280-slfo.1.1_1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-33412",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33412"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim\u0027s glob() function on Unix-like systems. By including a newline character (\\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user\u0027s \u0027shell\u0027 setting. This issue has been patched in version 9.2.0202.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:vim-data-common-9.2.0280-slfo.1.1_1.1.noarch",
          "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33412",
          "url": "https://www.suse.com/security/cve/CVE-2026-33412"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259985 for CVE-2026-33412",
          "url": "https://bugzilla.suse.com/1259985"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:vim-data-common-9.2.0280-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:vim-data-common-9.2.0280-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-14T08:33:54Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-33412"
    },
    {
      "cve": "CVE-2026-34714",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34714"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:vim-data-common-9.2.0280-slfo.1.1_1.1.noarch",
          "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34714",
          "url": "https://www.suse.com/security/cve/CVE-2026-34714"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261191 for CVE-2026-34714",
          "url": "https://bugzilla.suse.com/1261191"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:vim-data-common-9.2.0280-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:vim-data-common-9.2.0280-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-14T08:33:54Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-34714"
    },
    {
      "cve": "CVE-2026-34982",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34982"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:vim-data-common-9.2.0280-slfo.1.1_1.1.noarch",
          "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34982",
          "url": "https://www.suse.com/security/cve/CVE-2026-34982"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261271 for CVE-2026-34982",
          "url": "https://bugzilla.suse.com/1261271"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:vim-data-common-9.2.0280-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:vim-data-common-9.2.0280-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:vim-small-9.2.0280-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-14T08:33:54Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-34982"
    }
  ]
}

CVE-2026-34714 (GCVE-0-2026-34714)

Vulnerability from cvelistv5 – Published: 2026-03-30 18:27 – Updated: 2026-04-03 11:15

Summary

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

Severity ?

9.2 (Critical)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

mitre

References

URL

Tags

	https://www.openwall.com/lists/oss-security/2026/…
	https://github.com/vim/vim/security/advisories/GH…
	https://github.com/vim/vim/commit/664701eb7576edb…
	https://github.com/vim/vim/releases/tag/v9.2.0272

Impacted products

	Vendor	Product	Version
	Vim	Vim	Affected: 0 , < 9.2.0272 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34714",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T03:55:42.420298Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T13:50:15.296Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-04-03T11:15:39.723Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/04/02/4"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/04/02/5"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/04/03/6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Vim",
          "vendor": "Vim",
          "versions": [
            {
              "lessThan": "9.2.0272",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "9.2.0272",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-30T18:40:41.801Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/03/30/3"
        },
        {
          "url": "https://github.com/vim/vim/security/advisories/GHSA-2gmj-rpqf-pxvh"
        },
        {
          "url": "https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d600815ec1f43459"
        },
        {
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0272"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-34714",
    "datePublished": "2026-03-30T18:27:55.752Z",
    "dateReserved": "2026-03-30T18:27:55.398Z",
    "dateUpdated": "2026-04-03T11:15:39.723Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34982 (GCVE-0-2026-34982)

Vulnerability from cvelistv5 – Published: 2026-04-06 15:16 – Updated: 2026-04-07 03:56

Title

Vim modeline bypass via various options affects Vim < 9.2.0276

Summary

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.

Severity ?

8.2 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
	https://github.com/vim/vim/commit/75661a66a1db1e1…	x_refsource_MISC
	https://github.com/vim/vim/releases/tag/v9.2.0276	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	vim	vim	Affected: < 9.2.0276

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-04-06T15:19:17.901Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/04/01/1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34982",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-06T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-07T03:56:01.436Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0276"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-06T15:16:48.809Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9"
        },
        {
          "name": "https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0276",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0276"
        }
      ],
      "source": {
        "advisory": "GHSA-8h6p-m6gr-mpw9",
        "discovery": "UNKNOWN"
      },
      "title": "Vim modeline bypass via various options affects Vim \u003c 9.2.0276"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34982",
    "datePublished": "2026-04-06T15:16:48.809Z",
    "dateReserved": "2026-03-31T19:38:31.617Z",
    "dateUpdated": "2026-04-07T03:56:01.436Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33412 (GCVE-0-2026-33412)

Vulnerability from cvelistv5 – Published: 2026-03-24 19:43 – Updated: 2026-03-26 03:55

Title

Vim affected by Command injection via newline in glob()

Summary

Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.

Severity ?

5.6 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
	https://github.com/vim/vim/commit/645ed6597d1ea89…	x_refsource_MISC
	https://github.com/vim/vim/releases/tag/v9.2.0202	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	vim	vim	Affected: < 9.2.0202

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-24T20:16:21.339Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/19/10"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33412",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-25T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-26T03:55:39.372Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0202"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim\u0027s glob() function on Unix-like systems. By including a newline character (\\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user\u0027s \u0027shell\u0027 setting. This issue has been patched in version 9.2.0202."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-24T19:43:07.219Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c"
        },
        {
          "name": "https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0202",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0202"
        }
      ],
      "source": {
        "advisory": "GHSA-w5jw-f54h-x46c",
        "discovery": "UNKNOWN"
      },
      "title": "Vim affected by Command injection via newline in glob()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33412",
    "datePublished": "2026-03-24T19:43:07.219Z",
    "dateReserved": "2026-03-19T17:02:34.171Z",
    "dateUpdated": "2026-03-26T03:55:39.372Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

SUSE-SU-2026:21118-1

CVE-2026-34714 (GCVE-0-2026-34714)

CVE-2026-34982 (GCVE-0-2026-34982)

CVE-2026-33412 (GCVE-0-2026-33412)

Tags

Sightings

Nomenclature