Skip to main content

Vim netrw EUVDEUVD-2026-36281

| CVE-2026-47162 HIGH
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
2026-06-11 GitHub_M
RCE Vim Red Hat
7.3
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.3 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.0 HIGH

Trigger is a filesystem directory name (AV:L) the attacker need not own (PR:N), but the victim must browse it with netrw and re-source history (UI:R, AC:H); full user-context RCE gives C/I/A:H.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat
7.3 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
A
Scope
X

Lifecycle Timeline

3
Patch available
Jun 11, 2026 - 20:01 EUVD
Source Code Evidence Fetched
Jun 11, 2026 - 19:20 vuln.today
Analysis Generated
Jun 11, 2026 - 19:20 vuln.today

DescriptionCVE.org

Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.

AnalysisAI

Vimscript code injection in the netrw plugin shipped with Vim before 9.2.0495 allows attackers who can plant or have a victim browse a maliciously named directory to execute arbitrary Vimscript and shell commands in the user's Vim session. The flaw resides in s:NetrwBookHistSave(), which serializes directory paths into ~/.vim/.netrwhist using unescaped single-quoted string literals, so a directory name containing a single quote breaks out of the literal and is executed the next time Vim sources the history. No public exploit identified at time of analysis, but a proof-of-concept payload is embedded in the upstream regression test (Test_netrw_injection).

Technical ContextAI

Netrw is Vim's built-in file-system browser plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim), and it persists a per-user directory bookmark/history file at ~/.vim/.netrwhist that is re-sourced as Vimscript on subsequent launches. The vulnerable line constructed assignments using simple string concatenation: 'let g:netrw_dirhist_<n>=\'<path>\'', meaning any apostrophe inside <path> terminated the literal early and the remainder was interpreted as Vimscript - a textbook CWE-74 injection where untrusted data (filesystem-supplied directory names) is interpolated into an output language without neutralization. The fix replaces the hand-rolled quoting with Vim's built-in string() function, which performs correct escaping and round-trips arbitrary names safely (commit f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b). Affected CPE is cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* for all builds prior to 9.2.0495.

RemediationAI

Vendor-released patch: Vim 9.2.0495 - upgrade Vim (or the netrw runtime files) to this version or later, per the advisory at https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c and the tagged release https://github.com/vim/vim/releases/tag/v9.2.0495. If a full Vim upgrade is not immediately possible, replace just runtime/pack/dist/opt/netrw/autoload/netrw.vim with the fixed version from commit f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b, which swaps the unsafe single-quote concatenation for string(g:netrw_dirhist_{cnt}). As a workaround, disable netrw entirely by adding 'let g:loaded_netrw = 1' and 'let g:loaded_netrwPlugin = 1' to ~/.vimrc (side effect: breaks gx, :Explore, and remote file editing over scp://); alternatively delete or make read-only any existing ~/.vim/.netrwhist and set 'let g:netrw_dirhistmax = 0' to suppress writing/sourcing of the history file (side effect: loss of netrw directory history across sessions). Users should also audit and remove any existing ~/.vim/.netrwhist that may already contain injected payloads from prior browsing.

More in Vim

View all
CVE-2022-3520 CRITICAL POC
9.8 Dec 02

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. Rated critical severity (CVSS 9.8), this vuln
CVE-2022-0729 HIGH POC
8.8 Feb 23

Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this

CVE-2026-34714 HIGH POC
8.6 Mar 30

Code execution vulnerability in Vim before 9.2.0272 allows attackers to gain immediate arbitrary command execution upon

CVE-2019-12735 HIGH POC
8.6 Jun 05

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via th
CVE-2021-3968 HIGH POC
8.0 Nov 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 8.0), this vulnerability is remotely exploita
CVE-2023-4735 HIGH POC
7.8 Sep 02

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847. Rated high severity (CVSS 7.8), this vulnerability i
CVE-2023-4781 HIGH POC
7.8 Sep 05

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. Rated high severity (CVSS 7.8), this vulnerab
CVE-2023-4734 HIGH POC
7.8 Sep 02

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846. Rated high severity (CVSS 7.8), this vuln
CVE-2023-4733 HIGH POC
7.8 Sep 04

Use After Free in GitHub repository vim/vim prior to 9.0.1840. Rated high severity (CVSS 7.8), this vulnerability is no

CVE-2023-4750 HIGH POC
7.8 Sep 04

Use After Free in GitHub repository vim/vim prior to 9.0.1857. Rated high severity (CVSS 7.8), this vulnerability is no

CVE-2023-4736 HIGH POC
7.8 Sep 02

Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833. Rated high severity (CVSS 7.8), this vulnerability
CVE-2023-2610 HIGH POC
7.8 May 09

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. Rated high severity (CVSS 7.8), this vuln

Same weakness CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2016-4010 CRITICAL POC
9.8
CVE-2015-1592 HIGH POC
7.5
CVE-2025-20281 CRITICAL POC
10.0
CVE-2015-7309 MEDIUM POC
6.5
CVE-2014-8423 CRITICAL POC
10.0
CVE-2020-8468 HIGH POC
8.8
CVE-2015-3253 CRITICAL
9.8

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

EUVD-2026-36281 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy