Command Injection in Vim tar.vim Lets Crafted .tgz Filenames Execute Shell Commands
Vim disclosed a medium-severity command injection flaw in its tar.vim plugin, tracked as CVE-2026-46483 and GHSA-2fpv-9ff7-xg5w, affecting versions earlier than 9.2.479. The bug is in tar#Vimuntar() in runtime/autoload/tar.vim, where .tgz archive filenames are passed to shell commands such as gunzip and gzip -d using shellescape() without the required special handling, allowing Vim command-line special-character expansion on Unix-like systems.
A successful attack can execute arbitrary shell commands with the privileges of the user running Vim if a victim has the tar plugin enabled, has a malicious archive on disk, and manually runs the non-routine :Vimuntar command. The issue was reported and analyzed by Aisle Research, disclosed by Christian Brabandt, and fixed in Vim patch v9.2.479.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
3 events from the most recent confirmed update back to the earliest known activity.
Vim vulnerability CVE-2026-46483 is publicly disclosed
Christian Brabandt publicly disclosed the medium-severity vulnerability as CVE-2026-46483 and GHSA-2fpv-9ff7-xg5w. Advisory details explained that crafted .tgz filenames could trigger arbitrary shell command execution in the context of the Vim user.
Vim fixes CVE-2026-46483 in patch v9.2.479
Vim addressed the tar.vim command injection vulnerability in patch v9.2.479. Exploitation required a crafted archive filename, the tar plugin to be enabled, and a user to manually invoke the :Vimuntar command.
Aisle Research reports and analyzes command injection in Vim tar.vim
Aisle Research identified a command injection flaw in Vim's tar plugin affecting versions earlier than 9.2.479. The issue stems from tar#Vimuntar() using shellescape() without the special flag when handling .tgz archive filenames on Unix-like systems.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Vim Fixed Two Command Injection Flaws in Tag Handling and netrw
The Vim project disclosed and patched two medium-severity command injection vulnerabilities that could let attackers run shell commands as the local Vim user. One flaw, fixed in `v9.2.0357`, affected tag navigation in versions before that release: Vim passed the filename field from a `tags` file through wildcard expansion, allowing backtick expressions in a malicious tag entry to trigger command execution when a user invoked tag lookups such as `:tag`, `Ctrl-]`, or `vim -t`. Because Vim checks for `tags` files in the working directory by default, a repository-hosted malicious `tags` file was identified as a plausible delivery path. A second flaw, fixed in `v9.2.0383`, affected Vim's bundled `netrw` plugin in versions earlier than that patch. The bug allowed crafted `sftp://` or `file://` URLs to influence temporary filenames derived from attacker-controlled suffixes, which could then be passed to external programs such as `sftp` or configured file handlers without proper escaping, leading to arbitrary OS command execution when a user opened a malicious URL. The netrw issue was reported by Joshua Rogers of AISLE Research Team, and both disclosures said CVE assignments had been requested but were not yet available at publication time.
Apr 26, 2026Vim Cucumber Plugin Code Injection Lets Malicious Repos Execute Ruby
Vim disclosed a medium-severity code injection flaw in its Cucumber filetype plugin that affects versions earlier than `9.2.0496` when compiled with `+ruby` support. The bug is in `s:stepmatch()` in `runtime/ftplugin/cucumber.vim`, where attacker-controlled step-definition regex patterns from repository `.rb` files were inserted into Ruby `Kernel.eval()` without sufficient escaping, allowing arbitrary Ruby execution and potentially shell command execution. The issue is tracked in GitHub Security Advisory `GHSA-4473-94jm-w5x9` and mapped to `CWE-94` and `CWE-95`. Exploitation requires a user to open a malicious cucumber-style repository and trigger the step-jump mappings `[`d`]` or `]d` on a matching feature line; the vulnerability does **not** fire through omni-completion alone because `CucumberComplete()` does not call the vulnerable path. Vim fixed the bug in patch `9.2.0496` by replacing `Kernel.eval()` with `Regexp.new()`, keeping the regex as untrusted data rather than executable code, and added a regression test using a proof-of-concept payload that attempted to invoke `system("touch ...")`. The project credited Aisle Research for reporting and analyzing the flaw.
May 25, 2026
Vim Modeline Bypass Enables Arbitrary Command Execution
Vim disclosed a high-severity vulnerability that lets attackers achieve arbitrary OS command execution when a user opens a crafted file in affected versions earlier than **9.2.0276**. The flaw is a modeline sandbox bypass caused by missing security-related `P_MLE` flags on the `complete`, `guitabtooltip`, and `printheader` options, allowing unsafe behavior from modelines that should have been restricted. The bug also involves a missing `check_secure()` call in `mapset()`, which creates additional exploitation paths through key mappings and option handling. Researchers showed that the `complete` option could abuse `F{func}` callback syntax without the protections applied to `completefunc`, while `guitabtooltip` and `printheader` could be leveraged through `mapset()`. Vim fixed the issue in patch **v9.2.0276**, and the advisory was later assigned **CVE-2026-34982**; the project credited **dfwjj x** and **Avishay Matayev** for the discovery and analysis.
Apr 2, 2026