Vim has OS Command Injection in netrw
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2026-28417 vim Fixed in: 9.2.0078-r0
- Debian DEBIAN-CVE-2026-28417 vim
- Ubuntu UBUNTU-CVE-2026-28417 vim Fixed in: 2:7.4.052-1ubuntu3.1+esm23
Original description The description as published by the source.
Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web openwall.com
- web github.com