diff --git a/vim-9.0.2092-CVE-2026-41411.patch b/vim-9.0.2092-CVE-2026-41411.patch
new file mode 100644
index 0000000000000000000000000000000000000000..ecc05190cdbaad361cc8320b0f328d6b3786d969
--- /dev/null
+++ b/vim-9.0.2092-CVE-2026-41411.patch
@@ -0,0 +1,72 @@
+From c78194e41d5a0b05b0ddf383b6679b1503f977fb Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Wed, 15 Apr 2026 20:17:17 +0000
+Subject: [PATCH] patch 9.2.0357: [security]: command injection via backticks
+ in tag files
+
+Problem:  [security]: command injection via backticks in tag files
+          (Srinivas Piskala Ganesh Babu, Andy Ngo)
+Solution: Disallow backticks before attempting to expand filenames.
+
+Github Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8
+
+Supported by AI
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Adapted-by: PkgAgent (modified to adapt to opencloudos-stream)
+
+---
+ src/tag.c                    |    4 +++-
+ src/testdir/test_tagjump.vim |   22 ++++++++++++++++++++++
+ 2 files changed, 25 insertions(+), 1 deletion(-)
+
+diff --git a/src/tag.c b/src/tag.c
+index 6d9e66b..3bbde8a 100644
+--- a/src/tag.c
++++ b/src/tag.c
+@@ -4098,8 +4098,10 @@ expand_tag_fname(char_u *fname, char_u *tag_fname, int expand)
+ 
+     /*
+      * Expand file name (for environment variables) when needed.
++     * Disallow backticks, they could execute arbitrary shell
++     * commands.  This is not needed for tag filenames.
+      */
+-    if (expand && mch_has_wildcard(fname))
++    if (expand && mch_has_wildcard(fname) && vim_strchr(fname, '`') == NULL)
+     {
+ 	ExpandInit(&xpc);
+ 	xpc.xp_context = EXPAND_FILES;
+diff --git a/src/testdir/test_tagjump.vim b/src/testdir/test_tagjump.vim
+index 8b85bd6..fce4f14 100644
+--- a/src/testdir/test_tagjump.vim
++++ b/src/testdir/test_tagjump.vim
+@@ -1545,4 +1545,26 @@ func Test_tagbsearch()
+   set tags& tagbsearch&
+ endfunc
+ 
++" Test that backtick expressions in tag filenames are not expanded.
++" This prevents command injection via malicious tags files.
++func Test_tag_backtick_filename_not_expanded()
++  let pwned_file = 'Xtags_pwnd'
++  call assert_false(filereadable(pwned_file))
++
++  let tagline = "main\t`touch " .. pwned_file .. "`\t/^int main/;\"\tf"
++  call writefile([tagline], 'Xbt_tags', 'D')
++  call writefile(['int main(int argc, char **argv) {', '}'], 'Xbt_main.c', 'D')
++
++  set tags=Xbt_tags
++  sp Xbt_main.c
++
++  " The :tag command should fail to find the file, but must NOT execute
++  " the backtick shell command.
++  call assert_fails('tag main', 'E429:')
++  call assert_false(filereadable(pwned_file))
++
++  set tags&
++  bwipe!
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+
diff --git a/vim.spec b/vim.spec
index 3e71387826c203a302b320a4e4a590014db5e836..ecc193d95a76a745ce970d8dedf2379156e2f420 100644
--- a/vim.spec
+++ b/vim.spec
@@ -28,7 +28,7 @@ Summary:  The VIM editor
 URL:      http://www.vim.org/
 Name:     vim
 Version:  9.0.2092
-Release:  15%{?dist}
+Release:  16%{?dist}
 License:  Vim and MIT and GPL v2+
 Source0:  https://github.com/vim/vim/archive/refs/tags/v%{version}.tar.gz
 Source1:  virc
@@ -100,6 +100,8 @@ Patch0032: 0001-patch-9.2.0202-security-command-injection-via-newlin.patch
 Patch0033: 0001-patch-9.2.0276-security-modeline-security-bypass.patch
 # CVE-2026-35177
 Patch0034: 0001-patch-9.2.0280-security-path-traversal-issue-in-zip..patch
+# CVE-2026-41411
+Patch0035: vim-9.0.2092-CVE-2026-41411.patch
 
 Patch3000: vim-7.3-manpage-typo-668894-675480.patch
 Patch3001: vim-manpagefixes-948566.patch
@@ -901,6 +903,10 @@ LC_ALL=en_US.UTF-8  make test || echo "Warning: tests have failure."
 
 
 %changelog
+* Wed May 06 2026 PkgAgent Robot <pkgagent@opencloudos.tech> - 9.0.2092-16
+- [Type] security
+- [DESC] Fix CVE-2026-41411
+
 * Tue Apr 07 2026 cunlongli <cunlongli@tencent.com> - 9.0.2092-15
 - [Type] security
 - [DESC] fix CVE-2026-34982 CVE-2026-35177