CVE-2026-33412

Name	CVE-2026-33412
Description	Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1131450

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
vim (PTS)	bullseye	2:8.2.2434-3+deb11u1	vulnerable
	bullseye (security)	2:8.2.2434-3+deb11u3	vulnerable
	bookworm	2:9.0.1378-2+deb12u2	vulnerable
	trixie	2:9.1.1230-2	vulnerable
	forky	2:9.2.0218-1	fixed
	sid	2:9.2.0315-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
vim	source	(unstable)	2:9.2.0218-1			1131450

Notes

https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c
https://github.com/vim/vim/pull/19746
Fixed by: https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a (v9.2.0202)