Skip to content
Fencer Vulns
low 3.6

CVE-2026-46483 json

Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag

published 2026-05-15 5 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-30542

cvss
3.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479.

Patch / fix

  • vim vim 9.2.0479
  • vim Debian 13 2:9.1.1230-2+deb13u1
  • vim Debian 14 2:9.2.0524-1

debian advisories DEBIAN-CVE-2026-46483

  • vim Ubuntu 22.04 LTS 2:8.2.3995-1ubuntu2.31
  • vim Ubuntu 24.04 LTS 2:9.1.0016-1ubuntu7.15
  • vim Ubuntu 25.10 2:9.1.0967-1ubuntu6.6
  • vim Ubuntu 26.04 LTS 2:9.1.2141-1ubuntu4.3
  • vim Ubuntu Pro 14.04 LTS 2:7.4.052-1ubuntu3.1+esm28
  • vim Ubuntu Pro 16.04 LTS 2:7.4.1689-3ubuntu1.5+esm34
  • vim Ubuntu Pro 18.04 LTS 2:8.0.1453-1ubuntu1.13+esm19
  • vim Ubuntu Pro 20.04 LTS 2:8.1.2269-1ubuntu5.32+esm7

ubuntu advisories UBUNTU-CVE-2026-46483

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • vim hummingbird 1 9.2.967-1.1.hum1
  • xxd hummingbird 1 9.2.967-1.1.hum1
  • vim-X11 hummingbird 1 9.2.967-1.1.hum1
  • vim-data hummingbird 1 9.2.967-1.1.hum1
  • vim-common hummingbird 1 9.2.967-1.1.hum1
  • vim-minimal hummingbird 1 9.2.967-1.1.hum1
  • vim-enhanced hummingbird 1 9.2.967-1.1.hum1
  • vim-filesystem hummingbird 1 9.2.967-1.1.hum1

red hat advisories RHSA-2026:69128RHSA-2026:68711RHSA-2026:57614RHSA-2026:38511RHSA-2026:38510RHSA-2026:38509

  • vim SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 9.2.0530-150000.5.94.1
  • vim Linux Micro Extras 6.2 9.2.0530-160000.1.1

suse advisories SUSE-SU-2026:2313-1SUSE-SU-2026:21833-1

  • vim openSUSE Tumbleweed 9.2.0530-1.1

opensuse advisories openSUSE-SU-2026:11114-1

  • xxd AlmaLinux 10 2:9.1.083-9.el10_2.7
  • vim-X11 AlmaLinux 10 2:9.1.083-9.el10_2.7
  • vim-data AlmaLinux 10 2:9.1.083-9.el10_2.7
  • vim-common AlmaLinux 10 2:9.1.083-9.el10_2.7
  • vim-minimal AlmaLinux 10 2:9.1.083-9.el10_2.7
  • vim-enhanced AlmaLinux 10 2:9.1.083-9.el10_2.7
  • vim-filesystem AlmaLinux 10 2:9.1.083-9.el10_2.7
  • vim-X11 AlmaLinux 8 2:8.0.1763-27.el8_10

almalinux advisories ALSA-2026:38509ALSA-2026:38510ALSA-2026:38511

  • vim Rocky Linux 10 2:9.1.083-9.el10_2.7
  • vim Rocky Linux 9 2:8.2.2637-26.el9_8.10
  • vim Rocky Linux 8 2:8.0.1763-27.el8_10

rocky linux advisories RLSA-2026:38509RLSA-2026:38511RLSA-2026:38510

  • vim Alpine 3.24, Alpine 3.23 9.2.0481-r0

alpine advisories ALPINE-CVE-2026-46483

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • vim Azure Linux 3.0 9.2.0488-1

azure linux advisories AZL-86895

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-46483 updated cvss 7.0

vim: command injection when decompressing .tgz archives

  • Red Hat Enterprise Linux AppStream (v. 8) vim-common 8.0.1763-27.el8_10
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:38510
  • Red Hat Enterprise Linux AppStream (v. 9) vim-common 8.2.2637-26.el9_8.10
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:38511
  • Red Hat Enterprise Linux AppStream (v. 10) vim-common 9.1.083-9.el10_2.7
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:38509
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) vim-X11 8.0.1763-15.el8_4.2, vim-common 8.0.1763-15.el8_4.2, vim-enhanced 8.0.1763-15.el8_4.2, vim-filesystem 8.0.1763-15.el8_4.2
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:33453
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) vim-X11 8.0.1763-19.el8_6.6, vim-common 8.0.1763-19.el8_6.6, vim-enhanced 8.0.1763-19.el8_6.6, vim-filesystem 8.0.1763-19.el8_6.6
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:34477
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) vim-X11 8.0.1763-20.el8_8.2, vim-common 8.0.1763-20.el8_8.2, vim-enhanced 8.0.1763-20.el8_8.2, vim-filesystem 8.0.1763-20.el8_8.2
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:34476
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) vim-X11 8.2.2637-20.el9_2.2, vim-common 8.2.2637-20.el9_2.2, vim-enhanced 8.2.2637-20.el9_2.2
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:28133
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) vim-X11 8.2.2637-20.el9_4.3, vim-common 8.2.2637-20.el9_4.3, vim-enhanced 8.2.2637-20.el9_4.3
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:28049
show 32 more
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) xxd 9.1.083-5.el10_0.3, vim-X11 9.1.083-5.el10_0.3, vim-common 9.1.083-5.el10_0.3, vim-enhanced 9.1.083-5.el10_0.3
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:30900
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) vim-X11 8.2.2637-22.el9_6.3, vim-common 8.2.2637-22.el9_6.3, vim-enhanced 8.2.2637-22.el9_6.3
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:28050
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) vim-X11 8.0.1763-15.el8_4.2, vim-common 8.0.1763-15.el8_4.2, vim-enhanced 8.0.1763-15.el8_4.2, vim-filesystem 8.0.1763-15.el8_4.2
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:33453
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) vim-X11 8.0.1763-19.el8_6.6, vim-common 8.0.1763-19.el8_6.6, vim-enhanced 8.0.1763-19.el8_6.6, vim-filesystem 8.0.1763-19.el8_6.6
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:34477
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) vim-X11 8.0.1763-20.el8_8.2, vim-common 8.0.1763-20.el8_8.2, vim-enhanced 8.0.1763-20.el8_8.2, vim-filesystem 8.0.1763-20.el8_8.2
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:34476
  • Red Hat Enterprise Linux BaseOS (v. 8) vim 8.0.1763-27.el8_10
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:38510
  • Red Hat Enterprise Linux BaseOS (v. 9) vim 8.2.2637-26.el9_8.10
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:38511
  • Red Hat Enterprise Linux BaseOS (v. 10) vim 9.1.083-9.el10_2.7
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:38509
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) vim 8.0.1763-15.el8_4.2, vim-minimal 8.0.1763-15.el8_4.2
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:33453
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) vim 8.0.1763-19.el8_6.6, vim-minimal 8.0.1763-19.el8_6.6
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:34477
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) vim 8.0.1763-20.el8_8.2, vim-minimal 8.0.1763-20.el8_8.2
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:34476
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) vim 8.2.2637-20.el9_2.2, vim-minimal 8.2.2637-20.el9_2.2, vim-filesystem 8.2.2637-20.el9_2.2
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:28133
  • Red Hat Enterprise Linux BaseOS E4S (v.9.4) vim 8.2.2637-20.el9_4.3, vim-minimal 8.2.2637-20.el9_4.3, vim-filesystem 8.2.2637-20.el9_4.3
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:28049
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) vim 9.1.083-5.el10_0.3, vim-data 9.1.083-5.el10_0.3, vim-minimal 9.1.083-5.el10_0.3, vim-filesystem 9.1.083-5.el10_0.3
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:30900
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) vim 8.2.2637-22.el9_6.3, vim-minimal 8.2.2637-22.el9_6.3, vim-filesystem 8.2.2637-22.el9_6.3
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:28050
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) vim 8.0.1763-15.el8_4.2, vim-minimal 8.0.1763-15.el8_4.2
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:33453
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) vim 8.0.1763-19.el8_6.6, vim-minimal 8.0.1763-19.el8_6.6
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:34477
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) vim 8.0.1763-20.el8_8.2, vim-minimal 8.0.1763-20.el8_8.2
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:34476
  • Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) vim 7.4.629-5.el6_10.4, vim-X11 7.4.629-5.el6_10.4, vim-common 7.4.629-5.el6_10.4, vim-enhanced 7.4.629-5.el6_10.4
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:69128
  • Red Hat Enterprise Linux Server (v. 7 ELS) vim 7.4.629-8.el7_9.2, vim-X11 7.4.629-8.el7_9.2, vim-common 7.4.629-8.el7_9.2, vim-minimal 7.4.629-8.el7_9.2, vim-enhanced 7.4.629-8.el7_9.2
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:68711
  • Red Hat Hardened Images vim 9.2.967-1.1.hum1, xxd 9.2.967-1.1.hum1, vim-X11 9.2.967-1.1.hum1, vim-data 9.2.967-1.1.hum1, vim-common 9.2.967-1.1.hum1, vim-minimal 9.2.967-1.1.hum1, +3 more
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:57614
  • Red Hat OpenShift AI 3.4 rhai/base-image-neuron-rhel9 1790703542
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:74674
  • Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202608241157
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:59831
  • Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202608172040
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:56786
  • Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202608180329
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:56911
  • Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202608150307
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:56853
  • Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202608250221
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:60019
  • Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202608142238
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:57483
  • Red Hat OpenShift Container Platform 4.19 rhcos 4.19.9.6.202608182320
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:57402
  • Red Hat OpenShift Container Platform 4.20 rhcos 4.20.9.6.202608181658
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:57543
  • Red Hat OpenShift Container Platform 4.21 rhcos 4.21.9.6.202608180431
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:57457
  • Red Hat Update Infrastructure 5 rhui5/rhua-tp-rhel9 1787241260, rhui5/installer-tp-rhel9 1787135742, rhui5/cds-kubernetes-tp-rhel9 1787241211
    fixed: vendor fix “To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.” RHSA-2026:58981

9 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 3.6 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
NVD 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • vim vim

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command
  • CWE-88 Improper Neutralization of Argument Delimiters in a Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.