Skip to main content

Vim CVE-2026-28417

MEDIUM
Improper Neutralization of Invalid Characters in Identifiers in Web Pages (CWE-86)
2026-02-27 security-advisories@github.com
Command Injection Vim Red Hat Suse
4.4
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
4.4 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
SUSE
MEDIUM
qualitative
Red Hat
4.4 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Analysis Generated
Mar 12, 2026 - 21:55 vuln.today
Patch released
Mar 03, 2026 - 17:50 nvd
Patch available
CVE Published
Feb 27, 2026 - 22:16 nvd
MEDIUM 4.4

DescriptionGitHub Advisory

Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.

AnalysisAI

Arbitrary command execution in Vim's netrw plugin prior to version 9.2.0073 allows attackers to execute shell commands with user privileges by crafting malicious URLs (such as scp:// handlers) that users are tricked into opening. The vulnerability requires user interaction but poses a local privilege escalation risk in multi-user environments. A patch is available in Vim 9.2.0073 and later.

Technical ContextAI

Affects Vim. Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.

RemediationAI

A vendor patch is available — apply it immediately.

More in Vim

View all
CVE-2022-3520 CRITICAL POC
9.8 Dec 02

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. Rated critical severity (CVSS 9.8), this vuln
CVE-2022-0729 HIGH POC
8.8 Feb 23

Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this

CVE-2026-34714 HIGH POC
8.6 Mar 30

Code execution vulnerability in Vim before 9.2.0272 allows attackers to gain immediate arbitrary command execution upon

CVE-2019-12735 HIGH POC
8.6 Jun 05

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via th
CVE-2021-3968 HIGH POC
8.0 Nov 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 8.0), this vulnerability is remotely exploita
CVE-2023-4735 HIGH POC
7.8 Sep 02

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847. Rated high severity (CVSS 7.8), this vulnerability i
CVE-2023-4781 HIGH POC
7.8 Sep 05

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. Rated high severity (CVSS 7.8), this vulnerab
CVE-2023-4734 HIGH POC
7.8 Sep 02

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846. Rated high severity (CVSS 7.8), this vuln
CVE-2023-4733 HIGH POC
7.8 Sep 04

Use After Free in GitHub repository vim/vim prior to 9.0.1840. Rated high severity (CVSS 7.8), this vulnerability is no

CVE-2023-4750 HIGH POC
7.8 Sep 04

Use After Free in GitHub repository vim/vim prior to 9.0.1857. Rated high severity (CVSS 7.8), this vulnerability is no

CVE-2023-4736 HIGH POC
7.8 Sep 02

Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833. Rated high severity (CVSS 7.8), this vulnerability
CVE-2023-2610 HIGH POC
7.8 May 09

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. Rated high severity (CVSS 7.8), this vuln

Same weakness CWE-86 – Improper Neutralization of Invalid Characters in Identifiers in Web Pages

View all
CVE-2025-66606 CRITICAL
9.6
CVE-2023-31126 CRITICAL
9.6
CVE-2024-21864 HIGH
7.8
CVE-2024-10941 MEDIUM
6.5
CVE-2023-22840 MEDIUM
5.5
CVE-2025-20168 MEDIUM
5.4
CVE-2025-20167 MEDIUM
5.4
CVE-2025-20166 MEDIUM
5.4

Same technique Command Injection

View all
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Container rancher/elemental-channel/sl-micro:6.0-baremetal Container rancher/elemental-channel/sl-micro:6.0-base Container rancher/elemental-channel/sl-micro:6.0-kvm Container rancher/elemental-channel/sl-micro:6.0-rt Container suse/sl-micro/6.0/baremetal-iso-image:latest Container suse/sl-micro/6.0/base-iso-image:latest Container suse/sl-micro/6.0/kvm-iso-image:latest Container suse/sl-micro/6.0/rt-iso-image:latest Container suse/sl-micro/6.1/baremetal-iso-image:2.2.1-5.70 Container suse/sl-micro/6.1/base-iso-image:2.2.1-5.86 Container suse/sl-micro/6.1/kvm-iso-image:2.2.1-5.97 Container suse/sl-micro/6.1/rt-iso-image:2.2.1-5.74 Affected
Container suse/manager/5.0/x86_64/server:latest Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-EC2 Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.144 Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.74 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Affected
Container suse/sl-micro/6.0/base-os-container:latest Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.1/base-os-container:2.2.1-5.82 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.86 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.74 Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

Share

CVE-2026-28417 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy