{"cves":["CVE-2026-41411"],"cvss":0.0,"database_specific":{"severity":"MODERATE"},"description":"[9.1.083-9.0.1.el10_2.7]\n- Remove upstream references [Orabug: 31197557]\n\n[2:9.1.083-9.7]\n- RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave()\n- RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete\n\n[2:9.1.083-9.6]\n- RHEL-185867 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin\n\n[2:9.1.083-9.5]\n- RHEL-178233 CVE-2026-46483 vim: command injection in tar plugin\n\n[2:9.1.083-9.4]\n- RHEL-171481 CVE-2026-41411 vim: Command injection via backticks in tag files\n\n[2:9.1.083-9.3]\n- RHEL-170123 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite\n  via path traversal bypass\n\n[2:9.1.083-9.2]\n- Resolves: RHEL-164952 vim: arbitrary command execution via modeline sandbox bypass\n\n[2:9.1.083-9.1]\n- RHEL-159616 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function","id":"ELSA-2026-28210","ovalId":"oval:com.oracle.elsa:def:202628210","source":"oracle_linux","title":"ELSA-2026-28210:  vim security update (MODERATE)","url":"https://linux.oracle.com/errata/ELSA-2026-28210.html"}