CVE-2026-33412: 
Vim vulnerability analysis and mitigation

CVE-2026-33412 is a command injection vulnerability in Vim's glob() function affecting Unix-like systems, classified as CWE-78 (OS Command Injection). All Vim versions prior to 9.2.0202 are affected, including Microsoft's Azure Linux 3 and CBL-Mariner 2 packages (azl3_vim_9.2.0088-1, cbl2_vim_9.2.0088-1) and IBM API Connect. The vulnerability was discovered by researcher pyllyukko, disclosed publicly on March 19, 2026 via the oss-security mailing list, and patched the same day in Vim v9.2.0202. It carries a CVSS v3.1 base score of 7.3 (High) per NVD, though the GitHub advisory rates it 5.6 (Moderate) (GitHub Advisory, Openwall).

The root cause is that the newline character (\n) was absent from the SHELL_SPECIAL list of characters requiring escaping in src/os_unix.c. When Vim's glob() function (and related wildcard expansion features) processes a pattern, it ultimately calls mch_expand_wildcards(), which constructs a shell command string for execution. Because \n was not escaped, an attacker-controlled pattern containing a newline could act as a command separator, injecting arbitrary shell commands into the constructed string. The fix (commit 645ed65) adds \n to the SHELL_SPECIAL definition: changing "\t \"&'$;<>()\\|" to "\t \"&'$;<>()\\|\n". Exploitability depends on the user's configured 'shell' setting, as different shells handle newlines differently (GitHub Commit, GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary shell commands with the privileges of the user running Vim. The primary risk scenario involves a Vimscript plugin that passes untrusted user input to glob() — for example, a plugin processing filenames or paths supplied by an external source. The impact is primarily to integrity (unauthorized command execution) and potentially confidentiality (information disclosure), with no direct availability impact expected. Lateral movement is possible if the compromised user account has elevated privileges or access to sensitive resources (GitHub Advisory, Openwall).

1. Identify a target: Locate a system running Vim prior to version 9.2.0202 on a Unix-like OS, particularly one with a Vimscript plugin that passes user-controlled input to glob() or related wildcard expansion functions.
2. Craft a malicious input: Prepare a string containing a newline character (\n) followed by an arbitrary shell command (e.g., *.txt\nid > /tmp/pwned). The newline acts as a command separator when passed to the shell.
3. Deliver the payload: Induce the target user to open a specially crafted file, or interact with a plugin that processes attacker-controlled filenames or patterns — for example, a file manager plugin that calls glob() on user-supplied paths.
4. Trigger wildcard expansion: When Vim processes the glob pattern via mch_expand_wildcards(), the unescaped newline causes the shell to interpret the injected string as a separate command.
5. Achieve code execution: The injected shell command executes with the privileges of the user running Vim, enabling actions such as data exfiltration, persistence mechanisms, or further lateral movement (GitHub Advisory, GitHub Commit).

• Process: Unexpected child processes spawned by the Vim process (e.g., /bin/sh, /bin/bash, curl, wget, python) executing commands unrelated to normal editing activity.
• File System: Unexpected files created in world-writable directories (e.g., /tmp/) by the user running Vim; new cron jobs, SSH authorized keys, or scripts added under the user's home directory.
• Logs: Shell history files (.bash_history, .zsh_history) showing commands that were not interactively typed; audit logs (auditd) recording unusual execve calls originating from Vim's process tree.
• Network: Outbound connections from the Vim process or its child processes to external IP addresses, particularly on non-standard ports, indicating reverse shell or data exfiltration activity.

Upgrade Vim to version 9.2.0202 or later, which adds \n to the SHELL_SPECIAL escape list in src/os_unix.c, preventing newline injection (GitHub Commit, Vim Release). Distribution-specific patches are available via Red Hat (RHSA-2026:6502 and subsequent advisories), Amazon Linux 2023 (ALAS2023-2026-1584), openSUSE, Ubuntu, AlmaLinux, Rocky Linux, and Oracle Linux. If immediate patching is not feasible, review and restrict Vimscript plugins that pass user-controlled input to glob(), and consider setting Vim's 'shell' option to a shell that does not treat newlines as command separators. IBM API Connect users should apply the patch documented in IBM support page 7272626 (Red Hat Advisory, IBM Advisory).

The vulnerability was disclosed by Vim maintainer Christian Brabandt via the oss-security mailing list on March 19, 2026, crediting researcher pyllyukko for discovery and providing a detailed call chain analysis (Openwall). Red Hat, Microsoft, IBM, Amazon, openSUSE, Ubuntu, AlmaLinux, Rocky Linux, and Oracle Linux all issued advisories and patches within weeks of disclosure, reflecting broad ecosystem response. Coverage appeared on pro-linux.de and linuxcompatible.org, and the Yocto Project security list also tracked the issue. Community reaction was measured, consistent with the moderate severity rating and absence of active exploitation.