CVE-2026-46483

What it actually does

Vim before 9.2.0479 contains a local command injection flaw in the tar plugin function tar#Vimuntar() on Unix-like systems. When Vim opens or decompresses a crafted .tgz archive, runtime/autoload/tar.vim constructs :!gunzip and :!gzip -d commands using shellescape(tartail) without enabling Vim's {special} escaping mode. Because the string is later interpreted by Vim's command-line execution path, specially crafted archive filenames can trigger Vim command-line special expansion before the shell command runs. Successful exploitation executes attacker-controlled shell commands with the privileges of the user running Vim. Impact is limited by the invoking user's permissions and requires user interaction, but can affect confidentiality and integrity of files accessible to that user.

Why it matters to the business

An attacker who can convince a user or automation process to open a malicious .tgz archive in a vulnerable Vim version may run commands as that user, potentially stealing local files, modifying source code or configuration, planting persistence in user-owned startup files, or using the workstation as a foothold. The CVSS score is low and EPSS is currently low, and it is not listed in CISA KEV, but Vim is widely deployed on developer workstations, servers, build environments, and administrative systems, so exposure can be broad even where exploitation requires user action.

How an attack unfolds

An attacker prepares a .tgz archive with a filename crafted to abuse Vim command-line special expansion during tar plugin decompression. The attacker then delivers the archive through a plausible workflow such as source-code review, support attachment, package inspection, documentation bundle, or shared file transfer. A user opens the archive in Vim, or a local workflow invokes Vim against the archive. The vulnerable tar#Vimuntar() function builds a :!gunzip or :!gzip -d command using insufficient escaping. Vim expands special command-line sequences inside the crafted filename, causing attacker-controlled shell syntax or command content to be executed in the user's context. The payload can then read or modify files available to that user, drop additional scripts, alter shell startup files, or invoke network utilities if available.

How to fix it

Upgrade Vim to version 9.2.0479 or later on Unix-like systems. Where vendor packages backport fixes, install the vendor-patched Vim package and verify that the package changelog includes the tar.vim command-injection fix. If immediate upgrade is not possible, reduce exposure by preventing Vim from automatically handling untrusted .tgz archives, opening suspicious archives with safer tooling outside Vim, removing or disabling the vulnerable tar plugin where operationally acceptable, and educating users not to open unsolicited compressed archives in Vim. In managed environments, prioritize developer workstations, administrative jump hosts, build systems, CI runners, and servers where Vim may be used to inspect files from external sources.

How to confirm the fix worked

Confirm installed Vim reports version 9.2.0479 or later with `vim --version`, or confirm the operating-system package changelog contains the backported fix for this issue. Inspect the runtime tar plugin path used by Vim, typically under a Vim runtime directory such as `runtime/autoload/tar.vim`, and ensure it comes from the updated package. Test package inventory across Unix-like endpoints for Vim versions older than 9.2.0479. To validate mitigation, attempt to open only benign .tgz archives and confirm no unexpected shell commands are spawned by Vim during archive handling; in hardened environments, use process monitoring to verify Vim does not launch unexpected child shells or utilities beyond expected archive tooling.

Typical attack path

1. Identify targets likely to inspect compressed archives using Vim on Unix-like systems.
2. Create a malicious .tgz archive or archive filename designed to trigger Vim command-line special expansion during tar.vim decompression.
3. Deliver the archive through email, chat, issue trackers, repositories, shared storage, or another file-exchange workflow.
4. Wait for a user or local process to open the archive with a vulnerable Vim version before 9.2.0479.
5. Exploit tar#Vimuntar() command construction to execute shell commands as the Vim user.
6. Use the resulting user-level execution to read files, modify project content, install user-level persistence, or stage follow-on activity.

How to detect it

Look for evidence that Vim opened or decompressed a suspicious `.tgz` archive and then spawned shell commands or utilities beyond normal editing activity. Useful sources include EDR process trees, Linux auditd `EXECVE` records, shell history, process accounting, Sysmon for Linux, terminal session recording, file-integrity monitoring, and network proxy or firewall logs. Focus on parent-child relationships where `vim`, `gvim`, `view`, `rvim`, or `vimdiff` launches `/bin/sh` to run `gunzip` or `gzip -d`, followed by unexpected commands such as downloaders, interpreters, shells, credential-access tools, or file modification commands. Review user home directories for recently modified shell startup files such as `.bashrc`, `.profile`, `.zshrc`, `.ssh/authorized_keys`, cron entries, or newly dropped scripts shortly after the suspicious Vim activity. Because no public exploit payload or fixed filename pattern is provided, detection should be behavioral rather than based on a single static string.

• tar#Vimuntar
• :!gunzip
• :!gzip -d
• runtime/autoload/tar.vim
• vim -> /bin/sh
• gvim -> /bin/sh
• view -> /bin/sh
• vim -> gunzip
• vim -> gzip
• comm="vim"
• comm="gvim"
• comm="view"
• /bin/sh -c gunzip
• /bin/sh -c gzip -d
• .bashrc
• .profile
• .zshrc
• .ssh/authorized_keys

What your security team should do

• Inventory Vim installations across Linux, Unix, macOS, developer workstations, build hosts, and administrative servers; flag versions before 9.2.0479 or unverified vendor backports.
• Patch Vim to 9.2.0479 or a vendor-fixed build, prioritizing systems where users inspect third-party archives or source packages.
• Add endpoint detections for Vim spawning unexpected shell children, especially `/bin/sh`, `bash`, `zsh`, `curl`, `wget`, `python`, `perl`, `ruby`, `nc`, or `ssh` after opening archive files.
• Search historical telemetry for Vim processes that executed `gunzip` or `gzip -d` followed by unusual child processes or outbound network connections.
• Warn developers and administrators not to open untrusted `.tgz` archives directly in Vim until patched.
• If exploitation is suspected, preserve the malicious archive, Vim command/history files, shell history, endpoint process telemetry, and audit logs for timeline reconstruction.