PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46483 vim CVE debrief

A command injection vulnerability exists in Vim's tar plugin (tar#Vimuntar() in runtime/autoload/tar.vim) prior to version 9.2.0479. When decompressing .tgz archives on Unix-like systems, the function constructs :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag. This omission allows crafted archive filenames containing Vim cmdline-special characters to trigger expansion and execute arbitrary shell commands in the user's context. The vulnerability requires local access and user interaction to open a malicious archive, with attack complexity rated high due to the need for filename manipulation. The issue was disclosed on 2026-05-15 and last modified on 2026-05-19.

Vendor
vim
Product
Unknown
CVSS
LOW 3.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-15
Original CVE updated
2026-05-19
Advisory published
2026-05-15
Advisory updated
2026-05-19

Who should care

Vim users on Unix-like systems who regularly work with .tgz archives, particularly in environments where archives may originate from untrusted sources. System administrators managing multi-user environments with Vim installations. Security teams monitoring for local privilege escalation vectors in text editor plugins.

Technical summary

The tar#Vimuntar() function in Vim's runtime/autoload/tar.vim improperly uses shellescape() without the {special} flag when constructing shell commands for decompressing .tgz archives. This allows cmdline-special characters in crafted filenames to be expanded by Vim, resulting in arbitrary command execution. The vulnerability is local, requires user interaction to open a malicious archive, and has been fixed in Vim 9.2.0479.

Defensive priority

routine

Recommended defensive actions

  • Upgrade Vim to version 9.2.0479 or later to eliminate the command injection vulnerability in the tar plugin
  • If immediate patching is not feasible, avoid opening .tgz archives with untrusted or suspicious filenames in Vim
  • Review and restrict use of Vim's tar plugin in environments where users may encounter archives from untrusted sources
  • Monitor for anomalous shell command execution in user contexts where Vim is used to inspect archive contents

Evidence notes

Vulnerability confirmed through official GitHub security advisory and NVD analysis. Patch commit 3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1 addresses the issue by properly escaping special characters. CVSS 3.6 (LOW) reflects limited impact due to local attack vector and high complexity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46483 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46483

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46483 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46483

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.