SB2026051517 - OS Command Injection in Vim

Description

This security bulletin contains information about 1 vulnerability.

1) OS Command Injection (CVE-ID: CVE-2026-46483)

The vulnerability allows a remote attacker to execute arbitrary shell commands.

The vulnerability exists due to improper neutralization of special elements in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives via :Vimuntar on Unix-like systems. A remote attacker can supply a crafted archive filename to execute arbitrary shell commands.

User interaction is required to open the crafted file and invoke the non-routine :Vimuntar command, and only Unix-like systems with the tar plugin enabled are vulnerable.

Remediation

Install update from vendor's website.

References

• https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w
• https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1