CVE-2026-41411: Vim

Medium severity, CVSS 6.6. EPSS: 0.8% chance of exploitation in the next 30 days.

Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.

Affected products

• Vim Vim: before 9.2.0357 (fixed in 9.2.0357)

Published 2026-04-24. Last modified 2026-06-17.