{
  "cves": [
    "CVE-2026-46483",
    "CVE-2026-47162",
    "CVE-2026-47167",
    "CVE-2026-52858"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "IMPORTANT"
  },
  "description": "[9.1.083-9.0.1.el10_2.7]\n- Remove upstream references [Orabug: 31197557]\n\n[2:9.1.083-9.7]\n- RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave()\n- RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete\n\n[2:9.1.083-9.6]\n- RHEL-185867 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin\n\n[2:9.1.083-9.5]\n- RHEL-178233 CVE-2026-46483 vim: command injection in tar plugin\n\n[2:9.1.083-9.4]\n- RHEL-171481 CVE-2026-41411 vim: Command injection via backticks in tag files\n\n[2:9.1.083-9.3]\n- RHEL-170123 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite\n  via path traversal bypass\n\n[2:9.1.083-9.2]\n- Resolves: RHEL-164952 vim: arbitrary command execution via modeline sandbox bypass\n\n[2:9.1.083-9.1]\n- RHEL-159616 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function",
  "id": "ELSA-2026-38509",
  "ovalId": "oval:com.oracle.elsa:def:202638509",
  "source": "oracle_linux",
  "title": "ELSA-2026-38509:  vim security update (IMPORTANT)",
  "url": "https://linux.oracle.com/errata/ELSA-2026-38509.html"
}