Vim has OS Command Injection in netrw
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2026-28417 vim Corrigé dans: 9.2.0078-r0
- Debian DEBIAN-CVE-2026-28417 vim
- Ubuntu UBUNTU-CVE-2026-28417 vim Corrigé dans: 2:7.4.052-1ubuntu3.1+esm23
Description d'origine La description telle que publiée par la source (souvent en anglais).
Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web openwall.com
- web github.com