Skip to main content

Vim netrw EUVDEUVD-2026-36281

| CVE-2026-47162 HIGH
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
2026-06-11 GitHub_M
RCE Vim
7.3
CVSS 4.0 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Plant directory with quoted Vimscript payload
  2. Delivery
    Victim browses path in netrw
  3. Exploit
    NetrwBookHistSave writes unescaped name to ~/.vim/.netrwhist
  4. Execution
    Victim restarts Vim and sources history
  5. Persist
    Injected Vimscript executes via system()/:!
  6. Impact
    Attacker code runs as the user

Vulnerability Assessment

Weakness
CWE
CWE-74
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
Exploitation Conditions

Exploitation requires (1) the victim to be running Vim earlier than 9.2.0495 with the bundled netrw plugin loaded (default in most distributions), (2) the attacker to be able to place a directory whose name contains a single quote plus Vimscript payload on a filesystem the victim will browse - local disk, archive extraction, shared mount, repository checkout, or similar, (3) the victim to navigate into or bookmark that directory using netrw such that s:NetrwBookHistSave() runs and writes ~/.vim/.netrwhist, and (4) the victim to start a subsequent Vim session that sources the history file (default behavior when g:netrw_dirhistmax > 0). Exploitation is limited by needing active user interaction (netrw browsing), by operating systems or filesystems that reject single quotes in directory names (notably default Windows behavior, though NTFS itself permits them), and by users who have disabled netrw or set g:netrw_dirhistmax = 0.
Impact

The vendor CVSS 4.0 score is 7.3 (High) with AT:P, PR:L and UI:A, signalling that exploitation depends on a specific attack precondition (the crafted directory existing on the filesystem) and on active victim interaction (browsing it with netrw such that bookmark/history save fires, then re-launching Vim). No EPSS, KEV, or SSVC data was provided, and there is no public exploit identified at time of analysis, although the upstream commit ships a working injection payload as a unit test, which dramatically lowers the bar for any attacker to craft a working PoC. The realistic risk is moderate rather than mass-exploitable: this is a client-side RCE in a developer/sysadmin tool that triggers on subsequent Vim sessions, so it is well-suited to targeted attacks via shared workspaces, extracted archives, NFS/SMB mounts, or supply-chain repositories, but it is not a remotely reachable server bug. The CVSS 4.0 vector advertises AV:N, which is debatable given the attacker must influence the local filesystem the victim browses - defenders should treat the effective vector as local-with-network-delivery rather than pure network-reachable.
Exploit ScenarioDerived

An attacker plants a directory whose name contains a crafted single-quote-escaping Vimscript payload - for example via a tarball, git repository, shared network mount, or a writable team directory. When the victim later opens that location with netrw (e.g., :Explore or :edit on the parent) and netrw serializes the visit into ~/.vim/.netrwhist, the malicious name is written unescaped; the next Vim launch sources the history file and executes the injected Vimscript, which can shell out via system() or :! to run arbitrary commands as the user. A near-ready PoC exists in the upstream test Test_netrw_injection added in the same commit.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 11, 2026

Vimscript code injection in the netrw plugin shipped with Vim before 9.2.0495 allows attackers who can plant or have a victim browse a maliciously named directory to execute arbitrary Vimscript and shell commands in the user's Vim session. The flaw resides in s:NetrwBookHistSave(), which serializes directory paths into ~/.vim/.netrwhist using unescaped single-quoted string literals, so a directory name containing a single quote breaks out of the literal and is executed the next time Vim sources the history. No public exploit identified at time of analysis, but a proof-of-concept payload is embedded in the upstream regression test (Test_netrw_injection).

RemediationAI

Vendor-released patch: Vim 9.2.0495 - upgrade Vim (or the netrw runtime files) to this version or later, per the advisory at https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c and the tagged release https://github.com/vim/vim/releases/tag/v9.2.0495. If a full Vim upgrade is not immediately possible, replace just runtime/pack/dist/opt/netrw/autoload/netrw.vim with the fixed version from commit f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b, which swaps the unsafe single-quote concatenation for string(g:netrw_dirhist_{cnt}). As a workaround, disable netrw entirely by adding 'let g:loaded_netrw = 1' and 'let g:loaded_netrwPlugin = 1' to ~/.vimrc (side effect: breaks gx, :Explore, and remote file editing over scp://); alternatively delete or make read-only any existing ~/.vim/.netrwhist and set 'let g:netrw_dirhistmax = 0' to suppress writing/sourcing of the history file (side effect: loss of netrw directory history across sessions). Users should also audit and remove any existing ~/.vim/.netrwhist that may already contain injected payloads from prior browsing.

Affected VersionsENISA

vim < 9.2.0495

Affected Packages

euvd vim fix: 9.2.0495

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Netrw is Vim's built-in file-system browser plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim), and it persists a per-user directory bookmark/history file at ~/.vim/.netrwhist that is re-sourced as Vimscript on subsequent launches. The vulnerable line constructed assignments using simple string concatenation: 'let g:netrw_dirhist_<n>=\'<path>\'', meaning any apostrophe inside <path> terminated the literal early and the remainder was interpreted as Vimscript - a textbook CWE-74 injection where untrusted data (filesystem-supplied directory names) is interpolated into an output language without neutralization. The fix replaces the hand-rolled quoting with Vim's built-in string() function, which performs correct escaping and round-trips arbitrary names safely (commit f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b). Affected CPE is cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* for all builds prior to 9.2.0495.

Know when Vim gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 7.3 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
vuln.today AI 7.0 HIGH

Trigger is a filesystem directory name (AV:L) the attacker need not own (PR:N), but the victim must browse it with netrw and re-source history (UI:R, AC:H); full user-context RCE gives C/I/A:H.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat 7.3 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
Low
User Interaction
Active
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

1
Patch available
Jun 11, 2026 - 20:01 EUVD

DescriptionCVE.org

Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.

Executive ViewAI

Why It Matters

The Vim netrw plugin contains a code injection vulnerability enabling arbitrary command execution when users browse directories with specially crafted names; publicly available exploit code exists in the upstream regression test. This affects any organization where Vim users access untrusted file systems, with potential for complete system compromise through file naming attacks. No vendor-released patch identified at time of analysis.

Business Impact: High
Compensating Controls

Disable netrw plugin via .vimrc configuration; enforce strict file system access controls to prevent untrusted directory creation; restrict Vim to trusted file systems only; monitor ~/.vim/.netrwhist for suspicious or injected content; educate users to avoid opening Vim on external storage and unfamiliar directories; run Vim processes with minimal file system permissions via SELinux or AppArmor policies.

Threat Intelligence Overview

EPSS Score
0.0%
Top 86% exploitable
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

More in Vim

View all
CVE-2022-3520 CRITICAL POC
9.8 Dec 02

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. Rated critical severity (CVSS 9.8), this vuln
CVE-2022-0729 HIGH POC
8.8 Feb 23

Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this

CVE-2026-34714 HIGH POC
8.6 Mar 30

Code execution vulnerability in Vim before 9.2.0272 allows attackers to gain immediate arbitrary command execution upon

CVE-2019-12735 HIGH POC
8.6 Jun 05

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via th
CVE-2021-3968 HIGH POC
8.0 Nov 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 8.0), this vulnerability is remotely exploita
CVE-2022-1616 HIGH POC
7.8 May 07

Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. Rated high severity (CVSS 7.8), this vu
CVE-2022-1619 HIGH POC
7.8 May 08

Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. Rated high se
CVE-2021-4136 HIGH POC
7.8 Dec 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2021-3973 HIGH POC
7.8 Nov 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2021-3927 HIGH POC
7.8 Nov 05

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2022-2125 HIGH POC
7.8 Jun 19

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Rated high severity (CVSS 7.8), this vulnerability
CVE-2022-2126 HIGH POC
7.8 Jun 19

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Rated high severity (CVSS 7.8), this vulnerability is no a

Same weakness CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2013-2251 CRITICAL POC
9.8
CVE-2022-27924 HIGH POC
7.5
CVE-2016-4010 CRITICAL POC
9.8
CVE-2015-1592 HIGH POC
7.5
CVE-2025-20281 CRITICAL POC
10.0
CVE-2023-29525 HIGH POC
8.8
CVE-2015-7309 MEDIUM POC
6.5

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8451-1 ADVISORY https://vuldb.com/vuln/370433 REF https://access.redhat.com/errata/RHSA-2026:38509 REF https://access.redhat.com/errata/RHSA-2026:38510 REF https://access.redhat.com/errata/RHSA-2026:38511 REF https://access.redhat.com/errata/RHSA-2026:53371 REF https://access.redhat.com/errata/RHSA-2026:54769 REF https://access.redhat.com/errata/RHSA-2026:55431 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:68711 REF https://access.redhat.com/security/cve/CVE-2026-47162 REF https://bugzilla.redhat.com/show_bug.cgi?id=2487964 REF https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b REF https://github.com/vim/vim/releases/tag/v9.2.0495 REF https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47162.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy