CVE-2026-33412

Vim affected by Command injection via newline in glob()

CVSS 5.6 MEDIUMEPSS 0.7%CWE-78

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.6EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

24 mar 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

Produtos afetados

vim · vim

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a https://github.com/vim/vim/releases/tag/v9.2.0202 https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c http://www.openwall.com/lists/oss-security/2026/03/19/10