https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T00:35:34.358049+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-46483 CVE-2026-46483 — Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag 2026-09-29T00:35:34.604923+00:00

Affected: vim

Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479.