Vim's glob() function on Unix-like systems contains a flaw that allows a newline character within a passed pattern to invoke command injection. An attacker can trigger this vulnerability if the editor's 'shell' setting is configured to a usable shell, thereby enabling the execution of arbitrary shell commands. This weakness can compromise system integrity and potentially lead to full control of the affected machine, depending on the privileges of the Vim user.

The affected product is Vim for Linux and other Unix-like operating systems. All versions older than 9.2.0202 are vulnerable; the issue was fixed in the 9.2.0202 release.

The CVSS score of 5.6 indicates a moderate severity, while the EPSS score of less than 1% suggests that real-world exploitation is unlikely at the moment. The vulnerability is not listed in CISA's KEV catalog. Likely exploitation requires a local user to manipulate a glob() pattern, or an attacker who can supply a malicious input that is processed by Vim. In the absence of a remote code execution vector, the primary risk is local code execution.