CVE-2026-46483

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0479

Description A command injection issue exists in the tar#Vimuntar() function within runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function constructs :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag. This allows a specially crafted archive filename to trigger Vim cmdline-special expansion, leading to the execution of arbitrary shell commands within the user's context.

Recommendations Update to version 9.2.0479.