CVE-2026-33412Patch(vim / vim)

LOWCVSS 7.3 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch vim vim systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.

vim CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Patch / fix

Other references

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
5 mentions across 5 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 3 signals
Technical details provided in 4 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 4d ago at 1 mentions (2026-03-19); latest day: 1
5 total mentions across 5 days

Affected systems

Vendors

vim

Products

vim

Deep dive

Activity timeline5 mentions / 5d

Signal classification3 categories

Patch

360.0%

Disclosure

120.0%

General

120.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-19	1	Disclosure1
2026-03-31	1	General1
2026-04-13	1	Patch1
2026-04-15	1	Patch1
2026-04-20	1	Patch1

Full discourse5 posts

Open Source Security mailing list@oss_security203d
Disclosure
CVE-2026-33412: Vim: Command injection via newline in glob() affects Vim < 9.2.0202 https://www.openwall.com/lists/oss-security/2026/03/19/10 poses a significant risk if a Vimscript plugin passes untrusted user input into the glob() function
Post summary
The advisory discloses a command injection vulnerability in Vim’s glob() function, triggered by a newline in untrusted input, affecting versions prior to 9.2.0202.
01060399
4.4K followersView on X
M1000@_ssshashank178d
Patch
T7: 🚨 New CVE Alert: CVE-2026-33412 Even Vim isn’t safe. A simple newline (\n) in glob() → command injection. → Remote Code Execution on Unix systems → Low privilege, high impact → Patch immediately (>= 9.2.0202) https://www.sentinelone.com/vulnerability-database/cve-2026-33412/
Post summary
CVE‑2026‑33412 creates a command injection in Vim via a newline in glob(); patch to version 9.2.0202 or later is recommended.
01031157
61 followersView on X
Ferramentas Linux@Cezar_H_Linux171d
Patch
Vim command injection (CVE-2026-33412) can execute code just by opening a bad file. Here’s a bash script to check + patch on Ubuntu, Rocky Linux, SUSE → https://tinyurl.com/3r26u4j7 https://t.co/y6tptMWKcS
Post summary
The post alerts to a Vim command injection vulnerability (CVE-2026-33412), supplies a bash script to detect and patch it on several Linux distributions, and does not report active exploitation or an exploit.
1000069
1.5K followersView on X
Rahisisi@Hapankaalimehu176d
Patch
CVE-2026-32249 "A flaw was found in Vim. ... an attacker needs to be able to supply a malicious regex pattern" CVE-2026-33412 "newline character in a pattern passed to Vim's glob() function, an attacker may be able to execute arbitrary shell commands." Debian, RH patched
Post summary
The text reports two Vim vulnerabilities, explains their exploitation vectors, and notes that Debian and Red Hat have released patches, with no evidence of active exploitation or PoC.
0000039
430 followersView on X
Allen@MisalignedModel191d
General
@emilyzsh https://www.sentinelone.com/vulnerability-database/cve-2026-33412/
Post summary
A brief mention of CVE-2026-33412 with a link to a vulnerability database, but no specific details, PoC, or exploitation information provided.
0000041
286 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	vim	vim	-	-	-

Explore more

Back to dashboard vim CVEs vim vulnerabilities

What researchers are saying

CVE-2026-33412

Allen[verified]@MisalignedModelGeneral

A brief mention of CVE-2026-33412 with a link to a vulnerability database, but no specific details, PoC, or exploitation information provided.

Open Source Security mailing list@oss_securityDisclosure

The advisory discloses a command injection vulnerability in Vim’s glob() function, triggered by a newline in untrusted input, affecting versions prior to 9.2.0202.

M1000@_ssshashankPatch

CVE‑2026‑33412 creates a command injection in Vim via a newline in glob(); patch to version 9.2.0202 or later is recommended.

Ferramentas Linux@Cezar_H_LinuxPatch

The post alerts to a Vim command injection vulnerability (CVE-2026-33412), supplies a bash script to detect and patch it on several Linux distributions, and does not report active exploitation or an exploit.

Rahisisi@HapankaalimehuPatch

The text reports two Vim vulnerabilities, explains their exploitation vectors, and notes that Debian and Red Hat have released patches, with no evidence of active exploitation or PoC.