CVE-2026-28417

MEDIUM4.4

Vim has OS Command Injection in netrw

Published Feb 27, 2026

Modified 1 months ago

Details

Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.

References

WEB

http://www.openwall.com/lists/oss-security/2026/02/27/6

WEB

https://github.com/vim/vim/commit/79348dbbc09332130f4c860

WEB

https://github.com/vim/vim/releases/tag/v9.2.0073

WEB

https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-28417

CVSS Analysis