Vim processes tag files used to navigate code. In versions prior to 9.2.0357, the filename field from a tag entry undergoes wildcard expansion, which allows backtick syntax (e.g., `command`) to be interpreted and executed by the underlying shell. This flaw falls under CWE‑78 and results in arbitrary command execution with the privileges of the user running Vim.

All installations of Vim supplied by the Vim project, specifically any releases before 9.2.0357. The vulnerability is exploitable on any system where a user has read access to a tags file they can influence or where a malicious tag file is introduced.

The CVSS score of 6.6 indicates moderate severity. The EPSS score (<1%) suggests low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local access and the ability to craft or modify a tags file; it does not provide network‑level intrusion. Given its local execution nature, the risk is confined to the privileges of the Vim user. Potential attackers could gain confidentiality, integrity, or availability by running arbitrary commands on the host.