CVE-2026-46483

7.0 Élevée

Publiée le 15/05/2026 à 17:16 · Modifiée le 17/06/2026 à 12:53 · Analysée par le NVD · Source : security-advisories@github.com

Description

Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479.

Traduire en français

Produits concernés

vim
Vim vim

Scores CVSS

Version	Score	Source	Vecteur
3.1	3.6 Faible	security-advisories@github.com	`CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N`
3.1	7.0 Élevée	nvd@nist.gov (NVD)	`CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

Références

https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1 Patch
https://github.com/vim/vim/releases/tag/v9.2.0479 Product
https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w PatchVendor Advisory

CVE-2026-46483

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs