Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.

redhat RHSA-2026:28209: RHSA-2026:28209: vim security update (Moderate)

redhat RHSA-2026:28553: RHSA-2026:28553: vim security update (Moderate)

redhat RHSA-2026:28210: RHSA-2026:28210: vim security update (Moderate)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:28133 advisory.

    Vim (Vi IMproved) is an updated and improved version of the vi editor.

    Security Fix(es):

    * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)

    * vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177)

    * vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411)

    * vim: command injection when decompressing .tgz archives (CVE-2026-46483)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:28050 advisory.

    Vim (Vi IMproved) is an updated and improved version of the vi editor.

    Security Fix(es):

    * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)

    * vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177)

    * vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411)

    * vim: command injection when decompressing .tgz archives (CVE-2026-46483)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:28049 advisory.

    Vim (Vi IMproved) is an updated and improved version of the vi editor.

    Security Fix(es):

    * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)

    * vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177)

    * vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411)

    * vim: command injection when decompressing .tgz archives (CVE-2026-46483)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0300 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-41411:
    Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability     exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed     through wildcard expansion to resolve environment variables and wildcards. If the filename field contains     backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full     privileges of the running user.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8342-1 advisory.

    It was discovered that Vim did not properly handle backticks in tag filenames. An attacker could possibly     use this issue to execute arbitrary commands.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Vim installed on the remote host is prior to 9.2.0357. It is, therefore, affected by a vulnerability as referenced in the GHSA-cwgx-gcj7-6qh8 advisory.

  - A command injection vulnerability exists in Vim's tag file processing. A malicious tags file containing     backtick-enclosed shell commands in the filename field can trigger arbitrary shell command execution when     a user navigates tags. This vulnerability is fixed in 9.2.0357. (CVE-2026-41411)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1667 advisory.

    Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability     exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed     through wildcard expansion to resolve environment variables and wildcards. If the filename field contains     backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full     privileges of the running user. (CVE-2026-41411)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3292 advisory.

    Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability     exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed     through wildcard expansion to resolve environment variables and wildcards. If the filename field contains     backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full     privileges of the running user. (CVE-2026-41411)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8246-1 advisory.

    Micha Majchrowicz discovered that Vims zip plugin could overwrite arbitrary files. An attacker could     possibly use this issue to delete sensitive data or execute arbitrary code. This issue only affected     Ubuntu 26.04 LTS. (CVE-2026-35177)

    It was discovered that Vims netbeans interface did not properly sanitize certain strings. An attacker     could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 26.04 LTS.
    (CVE-2026-39881)

    It was discovered that Vim did not properly handle backticks in tag filenames. An attacker could possibly     use this issue to execute arbitrary commands. (CVE-2026-41411)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability     exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed     through wildcard expansion to resolve environment variables and wildcards. If the filename field contains     backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full     privileges of the running user. (CVE-2026-41411)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
322216	RHEL 9 : vim (RHSA-2026:28133)	Nessus	Red Hat Local Security Checks	high
321984	RHEL 9 : vim (RHSA-2026:28050)	Nessus	Red Hat Local Security Checks	high
321978	RHEL 9 : vim (RHSA-2026:28049)	Nessus	Red Hat Local Security Checks	high
319732	TencentOS Server 4: vim (TSSA-2026:0300)	Nessus	Tencent Local Security Checks	medium
318112	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : Vim vulnerability (USN-8342-1)	Nessus	Ubuntu Local Security Checks	medium
317736	Vim < 9.2.0357 Command Injection via Tag Filenames (GHSA-cwgx-gcj7-6qh8)	Nessus	Misc.	medium
315630	Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2026-1667)	Nessus	Amazon Linux Local Security Checks	medium
314581	Amazon Linux 2 : vim, --advisory ALAS2-2026-3292 (ALAS-2026-3292)	Nessus	Amazon Linux Local Security Checks	medium
314213	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Vim vulnerabilities (USN-8246-1)	Nessus	Ubuntu Local Security Checks	high
310517	Linux Distros Unpatched Vulnerability : CVE-2026-41411	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-41411

medium

Tenable Plugins

Coming Soon

high

high

high

medium

medium

medium

medium

medium

high

medium