Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Vim on CentOS allows crafted .tgz to run commands
published 5 months ago
Summary
The Vim editor packages for CentOS (vim-x11, vim-common, vim-enhanced, vim-filesystem, and vim-minimal) can be tricked by a specially named .tgz file to execute commands on the server. This could let an attacker run arbitrary code when the file is opened. Install the latest updates from CentOS repositories to remove the issue.
What to do
- Update centos vim-x11 to version 2:7.4.629-8.0.1.el7_9.tuxcare.els17.
- Update centos vim-common to version 2:7.4.629-8.0.1.el7_9.tuxcare.els17.
- Update centos vim-enhanced to version 2:7.4.629-8.0.1.el7_9.tuxcare.els17.
- Update centos vim-filesystem to version 2:7.4.629-8.0.1.el7_9.tuxcare.els17.
- Update centos vim-minimal to version 2:7.4.629-8.0.1.el7_9.tuxcare.els17.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:7 | centos | vim-x11 |
< 2:7.4.629-8.0.1.el7_9.tuxcare.els17 Fix: upgrade to 2:7.4.629-8.0.1.el7_9.tuxcare.els17
|
| TuxCare:CentOS:7 | centos | vim-common |
< 2:7.4.629-8.0.1.el7_9.tuxcare.els17 Fix: upgrade to 2:7.4.629-8.0.1.el7_9.tuxcare.els17
|
| TuxCare:CentOS:7 | centos | vim-enhanced |
< 2:7.4.629-8.0.1.el7_9.tuxcare.els17 Fix: upgrade to 2:7.4.629-8.0.1.el7_9.tuxcare.els17
|
| TuxCare:CentOS:7 | centos | vim-filesystem |
< 2:7.4.629-8.0.1.el7_9.tuxcare.els17 Fix: upgrade to 2:7.4.629-8.0.1.el7_9.tuxcare.els17
|
| TuxCare:CentOS:7 | centos | vim-minimal |
< 2:7.4.629-8.0.1.el7_9.tuxcare.els17 Fix: upgrade to 2:7.4.629-8.0.1.el7_9.tuxcare.els17
|
Original advisory text
vim: Fix of CVE-2026-46483
- CVE-2026-46483: fix OS command injection in tar plugin tar#Vimuntar() via crafted .tgz filename by using the {special} shellescape flag for the :! decompress command
References
Timeline
Published30 May 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1780055712 · OSV
Track software like this
Free during beta