CVE-2026-33412

A flaw was found in Vim. By including a newline character in a pattern passed to Vim's glob() function, an attacker may be able to execute arbitrary shell commands. This command injection vulnerability allows for arbitrary code execution, depending on the user's shell settings.

A command injection flaw was found in Vim's glob() function, which Red Hat Product Security has classified as having IMPORTANT impact. On Unix-like systems, an attacker who can control a pattern passed to glob() can include a newline character in the pattern, which may allow arbitrary shell commands to be executed with the privileges of the user running Vim, depending on the user's 'shell' setting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, score 7.3) indicates that exploitation requires local access, low privileges, and user interaction, and that a successful attack compromises the confidentiality, integrity, and availability of data accessible to the affected user. The Red Hat severity matches the NIST and upstream CVEORG ratings, so there is no difference from the upstream assessment. The vim component is affected in Red Hat Enterprise Linux (including Extended Lifecycle Support releases), in the Red Hat CoreOS container images shipped with OpenShift Container Platform 4, in Ansible Automation Platform, and in Fedora. A fix is being pursued for these affected products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.