Skip to main content

Vim CVE-2026-42307

MEDIUM
OS Command Injection (CWE-78)
2026-05-08 GitHub_M
Command Injection Vim
4.4
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
4.4 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
vuln.today AI
7.3 HIGH

OS command injection yields arbitrary execution as the user; C:H/I:H better reflects full user-level file access than vendor's C:L/I:L.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
4.4 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 24, 2026 - 00:23 vuln.today
Analysis Generated
Jul 24, 2026 - 00:23 vuln.today
CVE Published
May 08, 2026 - 22:38 nvd
MEDIUM 4.4

DescriptionCVE.org

Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.

AnalysisAI

OS command injection in Vim's netrw plugin prior to version 9.2.0383 allows arbitrary shell command execution at the privilege level of the Vim process when a user is induced to open a crafted sftp:// or file:// URL. The root cause is a two-part failure: the temporary file suffix extracted from the remote filename was not restricted to safe characters, and the resulting tmpfile path was passed unescaped to shell command construction in netrw#os#Execute(). No public exploit has been identified at time of analysis and SSVC confirms no observed exploitation, but the commit diff includes a regression test that demonstrates the injection path directly.

Technical ContextAI

The vulnerable component is Vim's netrw standard plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim), which provides remote file browsing and retrieval via protocols including sftp:// and file://. When fetching a remote file, netrw extracts a suffix from the remote filename using the regex \.[^./]\+$ and appends it to a locally-constructed temporary filename. Prior to the fix, this regex permitted any character except dot and slash in the suffix, meaning shell metacharacters such as semicolons, ampersands, and spaces were allowed. The unsanitized suffix then appeared in the tmpfile path, which was passed without quoting to netrw#os#Execute() - producing shell commands like sftp host:/foo.txt;id>/tmp/injected - causing the shell to interpret the injected fragment as a separate command. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) precisely describes this failure. The fix applies two mitigations: restricting the suffix regex to \w\+$ (word characters only) and wrapping the tmpfile argument with netrw#os#Escape() in both the sftp and file command invocations, with the unused g:netrw_tmpfile_escape variable removed as it provided no real protection. CPE cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* indicates all platform-agnostic Vim builds are affected.

RemediationAI

The primary remediation is upgrading Vim to version 9.2.0383 or later, available at the official tagged release https://github.com/vim/vim/releases/tag/v9.2.0383. Ubuntu users should apply the packages referenced in USN-8304-1. If immediate patching is not feasible, the most effective compensating control is to disable the netrw plugin entirely by adding 'let g:loaded_netrwPlugin = 1' to the Vim vimrc configuration before netrw loads - this prevents all netrw functionality from initializing and eliminates the vulnerable code path, with the trade-off that all netrw-based remote browsing and file retrieval (sftp://, ftp://, file://, etc.) will cease to function. A narrower mitigation is to avoid opening URLs from untrusted sources within Vim, though this relies on user discipline rather than technical enforcement. Organizations using Red Hat or Ubuntu distributions should monitor vendor security channels for packaged updates.

More in Vim

View all
CVE-2022-3520 CRITICAL POC
9.8 Dec 02

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. Rated critical severity (CVSS 9.8), this vuln
CVE-2022-0729 HIGH POC
8.8 Feb 23

Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this

CVE-2026-34714 HIGH POC
8.6 Mar 30

Code execution vulnerability in Vim before 9.2.0272 allows attackers to gain immediate arbitrary command execution upon

CVE-2019-12735 HIGH POC
8.6 Jun 05

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via th
CVE-2021-3968 HIGH POC
8.0 Nov 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 8.0), this vulnerability is remotely exploita
CVE-2023-4735 HIGH POC
7.8 Sep 02

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847. Rated high severity (CVSS 7.8), this vulnerability i
CVE-2023-4781 HIGH POC
7.8 Sep 05

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. Rated high severity (CVSS 7.8), this vulnerab
CVE-2023-4734 HIGH POC
7.8 Sep 02

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846. Rated high severity (CVSS 7.8), this vuln
CVE-2023-4733 HIGH POC
7.8 Sep 04

Use After Free in GitHub repository vim/vim prior to 9.0.1840. Rated high severity (CVSS 7.8), this vulnerability is no

CVE-2023-4750 HIGH POC
7.8 Sep 04

Use After Free in GitHub repository vim/vim prior to 9.0.1857. Rated high severity (CVSS 7.8), this vulnerability is no

CVE-2023-4736 HIGH POC
7.8 Sep 02

Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833. Rated high severity (CVSS 7.8), this vulnerability
CVE-2023-2610 HIGH POC
7.8 May 09

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. Rated high severity (CVSS 7.8), this vuln

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

Share

CVE-2026-42307 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy