Snyk test report

Improper Input Validation

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim package and not the vim package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the issue.

Remediation

Upgrade Alpine:3.23 vim to version 9.2.0078-r0 or higher.

References

• https://github.com/vim/vim/commit/65c1a143c331c886dc28
• https://github.com/vim/vim/releases/tag/v9.2.0077
• https://github.com/vim/vim/security/advisories/GHSA-r2gw-2x48-jj5p
• http://www.openwall.com/lists/oss-security/2026/02/27/10

---

OS Command Injection

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim package and not the vim package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.

Remediation

Upgrade Alpine:3.23 vim to version 9.2.0078-r0 or higher.

References

• https://github.com/vim/vim/commit/79348dbbc09332130f4c860
• https://github.com/vim/vim/releases/tag/v9.2.0073
• https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336
• http://www.openwall.com/lists/oss-security/2026/02/27/6

---

OS Command Injection

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim package and not the vim package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.

Remediation

Upgrade Alpine:3.23 vim to version 9.2.0219-r0 or higher.

References

• https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a
• https://github.com/vim/vim/releases/tag/v9.2.0202
• https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c
• http://www.openwall.com/lists/oss-security/2026/03/19/10

---

OS Command Injection

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim package and not the vim package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

Remediation

Upgrade Alpine:3.23 vim to version 9.2.0272-r0 or higher.

References

• https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d600815ec1f43459
• https://github.com/vim/vim/releases/tag/v9.2.0272
• https://github.com/vim/vim/security/advisories/GHSA-2gmj-rpqf-pxvh
• https://www.openwall.com/lists/oss-security/2026/03/30/3
• http://www.openwall.com/lists/oss-security/2026/04/02/4
• http://www.openwall.com/lists/oss-security/2026/04/02/5
• http://www.openwall.com/lists/oss-security/2026/04/03/6
• https://access.redhat.com/security/cve/CVE-2026-34714
• https://bugzilla.redhat.com/show_bug.cgi?id=2453139
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34714.json

---

Directory Traversal

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim package and not the vim package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

Vim is an open source, command line text editor. Prior to 9.2.0280, a path traversal bypass in Vim's zip.vim plugin allows overwriting of arbitrary files when opening specially crafted zip archives, circumventing the previous fix for CVE-2025-53906. This vulnerability is fixed in 9.2.0280.

Remediation

Upgrade Alpine:3.23 vim to version 9.2.0280-r0 or higher.

References

• https://github.com/vim/vim/security/advisories/GHSA-jc86-w7vm-8p24

---

Arbitrary Code Injection

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim package and not the vim package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.

Remediation

Upgrade Alpine:3.23 vim to version 9.2.0321-r0 or higher.

References

• https://github.com/vim/vim/commit/7ab76a86048ed492374ac6b19
• https://github.com/vim/vim/releases/tag/v9.2.0316
• https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6

---

OS Command Injection

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim package and not the vim package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479.

Remediation

Upgrade Alpine:3.23 vim to version 9.2.0481-r0 or higher.

References

• https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1
• https://github.com/vim/vim/releases/tag/v9.2.0479
• https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w

---

Arbitrary Code Injection

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim package and not the vim package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.

Remediation

Upgrade Alpine:3.23 vim to version 9.2.0481-r0 or higher.

References

• https://access.redhat.com/security/cve/CVE-2026-43961
• https://bugzilla.redhat.com/show_bug.cgi?id=2460434
• https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3
• http://www.openwall.com/lists/oss-security/2026/05/14/7

---

Arbitrary Code Injection

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim package and not the vim package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package's top-level code as the editing user. This issue has been patched in version 9.2.0561.

Remediation

Upgrade Alpine:3.23 vim to version 9.2.0498-r0 or higher.

References

• https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d
• https://github.com/vim/vim/releases/tag/v9.2.0561
• https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c

---

Out-of-bounds Read

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim package and not the vim package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars[] array with no upper bound, stopping only when it encounters a NUL terminator. When a cell legitimately fills all VTERM_MAX_CHARS_PER_CELL (6) slots — a base character plus five combining marks — the bundled libvterm returns the array without a terminating NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer reserved for only six characters. A program whose output is rendered inside a :terminal window can trigger this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in version 9.2.0565.

Remediation

Upgrade Alpine:3.23 vim to version 9.2.0567-r0 or higher.

References

• https://github.com/vim/vim/commit/63680c6d3d52477817b49cd1a66e7aabe8a7aa19
• https://github.com/vim/vim/releases/tag/v9.2.0565
• https://github.com/vim/vim/security/advisories/GHSA-47gw-8gc3-mgcm

---

Arbitrary Code Injection

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim package and not the vim package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluates function default values, parameter annotations, and class base expressions at definition time, so a hostile buffer can execute attacker-controlled Python expressions during omni-completion. The existing g:pythoncomplete_allow_import mitigation (GHSA-52mc-rq6p-rc7c) does not cover this path, because the attacker-controlled code is not a harvested import/from statement. This issue has been patched in version 9.2.0597.

Remediation

Upgrade Alpine:3.23 vim to version 9.2.0602-r0 or higher.

References

• https://github.com/vim/vim/commit/c8c63673bc4253212820626aeeb75999d9a539d2
• https://github.com/vim/vim/releases/tag/v9.2.0597
• https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c
• https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468
• https://access.redhat.com/security/cve/CVE-2026-52860
• https://bugzilla.redhat.com/show_bug.cgi?id=2487987
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52860.json

---

Arbitrary Command Injection

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim package and not the vim package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.vim falls back to PowerShell to browse, read, extract, update or delete entries in a zip archive, it builds the PowerShell command by inserting archive entry names that are quoted only for the shell, not for PowerShell. A crafted entry name can break out of the intended string context and cause PowerShell to execute arbitrary commands with the privileges of the user running Vim, triggered by opening, viewing or extracting the archive. This vulnerability is fixed in 9.2.0678.

Remediation

Upgrade Alpine:3.23 vim to version 9.2.0854-r0 or higher.

References

• https://github.com/vim/vim/commit/b2cc9be119d51212bf0d3f2a99
• https://github.com/vim/vim/releases/tag/v9.2.0678
• https://github.com/vim/vim/security/advisories/GHSA-x5fg-h5w9-9frf

---

CVE-2026-28390

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen.

Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service.

When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing.

Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Alpine:3.23 openssl to version 3.5.6-r0 or higher.

References

• https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc
• https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6
• https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4
• https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788
• https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75
• https://openssl-library.org/news/secadv/20260407.txt
• https://cert-portal.siemens.com/productcert/html/ssa-032379.html
• https://cert-portal.siemens.com/productcert/html/ssa-265688.html

---

CVE-2026-28388

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing.

Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.

When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference.

Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it.

The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Alpine:3.23 openssl to version 3.5.6-r0 or higher.

References

• https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e
• https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139
• https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3
• https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8
• https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726
• https://openssl-library.org/news/secadv/20260407.txt
• https://cert-portal.siemens.com/productcert/html/ssa-032379.html
• https://cert-portal.siemens.com/productcert/html/ssa-265688.html

---

CVE-2026-28389

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen.

Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service.

When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing.

Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Alpine:3.23 openssl to version 3.5.6-r0 or higher.

References

• https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5
• https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616
• https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f
• https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a
• https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686
• https://openssl-library.org/news/secadv/20260407.txt
• https://cert-portal.siemens.com/productcert/html/ssa-032379.html
• https://cert-portal.siemens.com/productcert/html/ssa-265688.html

---

CVE-2026-28387

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side.

Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code.

However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage.

By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable.

The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records.

No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.

Remediation

Upgrade Alpine:3.23 openssl to version 3.5.6-r0 or higher.

References

• https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b
• https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe
• https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3
• https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7
• https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177
• https://openssl-library.org/news/secadv/20260407.txt
• https://cert-portal.siemens.com/productcert/html/ssa-032379.html
• https://cert-portal.siemens.com/productcert/html/ssa-265688.html

---

Access of Resource Using Incompatible Type ('Type Confusion')

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.

Remediation

Upgrade Alpine:3.23 libxml2 to version 2.13.9-r1 or higher.

References

• https://access.redhat.com/errata/RHSA-2026:11503
• https://access.redhat.com/security/cve/CVE-2026-6732
• https://bugzilla.redhat.com/show_bug.cgi?id=2461300
• https://gitlab.gnome.org/GNOME/libxml2/-/issues/1097
• https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/411

---

Cleartext Transmission of Sensitive Information

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

Using libcurl, when a custom Host: header is first set for an HTTP request and a second request is subsequently done using the same easy handle but without the custom Host: header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.

Remediation

Upgrade Alpine:3.23 curl to version 8.20.0-r0 or higher.

References

• https://curl.se/docs/CVE-2026-6276.html
• https://curl.se/docs/CVE-2026-6276.json
• http://www.openwall.com/lists/oss-security/2026/04/29/13
• https://hackerone.com/reports/3671818

---

Server-Side Request Forgery (SSRF)

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers.

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should.

This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.

Remediation

Upgrade Alpine:3.23 curl to version 8.20.0-r0 or higher.

References

• https://curl.se/docs/CVE-2026-5773.html
• https://curl.se/docs/CVE-2026-5773.json
• http://www.openwall.com/lists/oss-security/2026/04/29/9
• https://hackerone.com/reports/3650689

---