CVE-2026-42307
Vim: OS Command Injection in netrw
CVSS Score
4.4
EPSS Score
0.0%
EPSS Percentile
0th
Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.
| CWE | CWE-78 |
| Vendor | vim |
| Product | vim |
| Published | May 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for vim vim
Be the first to know when new medium vulnerabilities affecting vim vim are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
vim / vim
< 9.2.0383