Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.
References
| Link | Resource |
|---|---|
| https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc | Patch |
| https://github.com/vim/vim/releases/tag/v9.2.0383 | Product |
| https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gx | Patch Vendor Advisory |
Configurations
History
14 May 2026, 13:55
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Vim vim
Vim |
|
| References | () https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc - Patch | |
| References | () https://github.com/vim/vim/releases/tag/v9.2.0383 - Product | |
| References | () https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gx - Patch, Vendor Advisory | |
| CPE | cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* |
08 May 2026, 23:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-08 23:16
Updated : 2026-05-14 13:55
NVD link : CVE-2026-42307
Mitre link : CVE-2026-42307
CVE.ORG link : CVE-2026-42307
JSON object : View
Products Affected
vim
- vim
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')