PT-2026-41308 · Vim+2 · Vim+2

Published 2026-05-15 · Updated 2026-06-23 · CVE-2026-46483

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0479

Description A command injection issue exists in the tar#Vimuntar() function within runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function constructs :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag. This allows a specially crafted archive filename to trigger Vim cmdline-special expansion, leading to the execution of arbitrary shell commands within the user's context.

Recommendations Update to version 9.2.0479.

Fix

OS Command Injection

Argument Injection

Weakness Enumeration

CWE-78

CWE-88

Related Identifiers

CLSA-2026-1780388996

CVE-2026-46483

ECHO-F203-4098-3FCC

OESA-2026-2472

OESA-2026-2473

OESA-2026-2474

OESA-2026-2475

OESA-2026-2476

OPENSUSE-SU-2026:11114-1

SUSE-SU-2026:2313-1

USN-8415-1

Affected Products

Linuxmint

Ubuntu

Vim

References · 54

• https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w · Vendor Advisory
• https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1 · Patch
• https://ubuntu.com/security/CVE-2026-46483 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46483 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2474 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8415-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45130 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-46483 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2475 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-46483 · Vendor Advisory
• https://osv.dev/vulnerability/CLSA-2026-1780388996 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2472 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2473 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44656 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2026-46483 · Vendor Advisory