ALPINE-CVE-2026-41411
Record from OSV · Published April 24, 2026
Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| vim | Alpine:v3.23 | 9.2.0357-r0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.23 | vim | 0, 7.2.284-r0, 7.2.394-r0 |
Timeline
- Apr 24, 2026 CVE Published
- Apr 30, 2026 Distribution Patch
- Jun 15, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln ALPINE-CVE-2026-41411
vulnetix vdb fixes ALPINE-CVE-2026-41411Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/ALPINE-CVE-2026-41411/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart