Threats affecting pkg:rpm/redhat/vim

Multiple security vulnerabilities have been identified in Vim (Vi IMproved) affecting Red Hat Enterprise Linux 9. These include command injection when decompressing .tgz archives and arbitrary code execution via crafted directory names, Python omni-completion, and crafted step-definition patterns. Red Hat has issued an important security advisory with updates to address these issues.

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749) * vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417) * vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421) * vim: Vim: Arbitrary code execution via command injection in glob() function (CVE-2026-33412) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.