The vulnerability resides in the tar#Vimuntar() function of Vim’s runtime autoload tar.vim, which builds shell commands without using the {special} flag for shellescape. A crafted .tgz archive filename can trigger Vim’s cmdline‑special expansion and allow execution of arbitrary shell commands in the user’s context. This constitutes a command‑line injection weakness (CWE‑78) and a shell‑execution flaw (CWE‑88). The CVSS score of 3.6 indicates moderate severity, reflecting that exploitation requires local user interaction and results in code execution with the victim’s privileges.

All Vim users running versions before 9.2.0479 on Unix‑like operating systems are affected, as the issue exists in the tar.vim script bundled with those releases. The vulnerability is resolved in Vim 9.2.0479 and later. No specific operating‑system versions are limited; the flaw is tied solely to the Vim release.

The risk localized to systems where an attacker can place a malicious .tgz file and persuade a user to open it in Vim. The absence of an EPSS score and the lack of listing in CISA’s KEV catalogue suggest the exploit is not yet widespread. Nonetheless, the CVSS score of 3.6 and the fact that the exploit requires only local user interaction mean that an unpatched user could execute arbitrary commands. No external attack vector beyond local file handling is documented in the description.