Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.
{
"cwe_ids": [
"CWE-78"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33412.json"
}[
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a",
"digest": {
"line_hashes": [
"146200493773228420153804765641940418619",
"102295068585587929460287727672530590118",
"12157954190914794197703146009250801464",
"34212075441979664765987089525913144227"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2026-33412-726b4494",
"target": {
"file": "src/version.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a",
"digest": {
"line_hashes": [
"99855468871233912062443484240707890604",
"12608813328814909400639984270747434802",
"129593041698368319600678680304455922012",
"148763127610672276394265674767619091609"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2026-33412-b270dbc8",
"target": {
"file": "src/os_unix.c"
}
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-33412.json"