Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NVim
APPVim< 9.2.0073
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
Related vulnerabilities
CVE-2026-34714CRITICAL9.2PL ✓same product
Vim: command injection przez %{expr} w tabpanel umożliwia RCE
CVE-2020-20703CRITICAL9.8PL ✓same product
Buffer Overflow w VIM 8.1.2135 umożliwiający zdalne wykonanie kodu
CVE-2022-3520CRITICAL9.8PL ✓same product
Przepełnienie bufora na stercie (heap buffer overflow) w edytorze Vim
CVE-2022-0318CRITICAL9.8PL ✓same product
Heap-based Buffer Overflow w Vim — przepełnienie sterty przed wersją 8.2
CVE-2017-6349CRITICAL9.8PL ✓same product
Integer overflow w Vim podczas odczytu uszkodzonego pliku undo