Command Injection Vulnerability in Vim's Tag File Processing

CVE-2026-41411

What is CVE-2026-41411?

Vim, a widely used open source command line text editor, has a command injection vulnerability that affects its tag file processing. In versions prior to 9.2.0357, an attacker can exploit this security flaw by creating a specially crafted tags file that includes backtick syntax, such as command. When Vim attempts to resolve the filename field within the tags file, it inadvertently allows execution of arbitrary commands through wildcard expansion. This exploitation occurs with the full privileges of the user running Vim, posing significant security risks.

References