SB2026062268 - Red Hat Enterprise Linux 9 update for vim
Published: June 22, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) OS Command Injection (CVE-ID: CVE-2026-34982)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to execute arbitrary OS commands.
The vulnerability exists due to improper neutralization of special elements used in an OS command in modeline processing for the complete, guitabtooltip, and printheader options and the mapset() function when opening a crafted file. A remote attacker can deliver a specially crafted file to execute arbitrary OS commands.
User interaction is required to open a crafted file.
2) Path traversal (CVE-ID: CVE-2026-35177)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to overwrite arbitrary files.
The vulnerability exists due to path traversal in zip.vim when processing specially crafted zip archives. A remote attacker can trick the victim into opening a crafted archive and editing a malicious file within it to overwrite arbitrary files.
User interaction is required, and the file is written when the victim attempts to save it using :w.
3) OS Command Injection (CVE-ID: CVE-2026-41411)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to execute arbitrary shell commands.
The vulnerability exists due to improper neutralization of special elements used in an os command in tag file processing when resolving tag filenames from a tags file. A remote attacker can place a specially crafted tags file entry containing backtick syntax and trigger tag navigation to execute arbitrary shell commands.
User interaction is required to perform tag navigation such as :tag, Ctrl-], or vim -t after opening Vim in a directory containing a malicious tags file.
4) OS Command Injection (CVE-ID: CVE-2026-46483)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to execute arbitrary shell commands.
The vulnerability exists due to improper neutralization of special elements in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives via :Vimuntar on Unix-like systems. A remote attacker can supply a crafted archive filename to execute arbitrary shell commands.
User interaction is required to open the crafted file and invoke the non-routine :Vimuntar command, and only Unix-like systems with the tar plugin enabled are vulnerable.
Remediation
Install update from vendor's website.