Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.
Weakness
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Vim | Vim | * | 9.2.0495 (excluding) |
| Red Hat Enterprise Linux 10 | RedHat | vim-2:9.1.083-9.el10_2.7 | * |
| Red Hat Enterprise Linux 8 | RedHat | vim-2:8.0.1763-27.el8_10 | * |
| Red Hat Enterprise Linux 8 | RedHat | vim-2:8.0.1763-27.el8_10 | * |
| Red Hat Enterprise Linux 9 | RedHat | vim-2:8.2.2637-26.el9_8.10 | * |
| Red Hat Enterprise Linux 9 | RedHat | vim-2:8.2.2637-26.el9_8.10 | * |
| Red Hat Insights proxy 1.5 | RedHat | insights-proxy/insights-proxy-container-rhel9:1786433656 | * |
| Vim | Ubuntu | esm-infra-legacy/trusty | * |
| Vim | Ubuntu | esm-infra-legacy/xenial | * |
| Vim | Ubuntu | esm-infra/bionic | * |
| Vim | Ubuntu | esm-infra/focal | * |
| Vim | Ubuntu | jammy | * |
| Vim | Ubuntu | noble | * |
| Vim | Ubuntu | questing | * |
| Vim | Ubuntu | resolute | * |
| Vim | Ubuntu | upstream | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/10.html
- https://cwe.mitre.org/data/definitions/101.html
- https://cwe.mitre.org/data/definitions/105.html
- https://cwe.mitre.org/data/definitions/108.html
- https://cwe.mitre.org/data/definitions/120.html
- https://cwe.mitre.org/data/definitions/13.html
- https://cwe.mitre.org/data/definitions/135.html
- https://cwe.mitre.org/data/definitions/14.html
- https://cwe.mitre.org/data/definitions/24.html
- https://cwe.mitre.org/data/definitions/250.html
- https://cwe.mitre.org/data/definitions/267.html
- https://cwe.mitre.org/data/definitions/273.html
- https://cwe.mitre.org/data/definitions/28.html
- https://cwe.mitre.org/data/definitions/3.html
- https://cwe.mitre.org/data/definitions/34.html
- https://cwe.mitre.org/data/definitions/42.html
- https://cwe.mitre.org/data/definitions/43.html
- https://cwe.mitre.org/data/definitions/45.html
- https://cwe.mitre.org/data/definitions/46.html
- https://cwe.mitre.org/data/definitions/47.html
- https://cwe.mitre.org/data/definitions/51.html
- https://cwe.mitre.org/data/definitions/52.html
- https://cwe.mitre.org/data/definitions/53.html
- https://cwe.mitre.org/data/definitions/6.html
- https://cwe.mitre.org/data/definitions/64.html
- https://cwe.mitre.org/data/definitions/67.html
- https://cwe.mitre.org/data/definitions/7.html
- https://cwe.mitre.org/data/definitions/71.html
- https://cwe.mitre.org/data/definitions/72.html
- https://cwe.mitre.org/data/definitions/76.html
- https://cwe.mitre.org/data/definitions/78.html
- https://cwe.mitre.org/data/definitions/79.html
- https://cwe.mitre.org/data/definitions/8.html
- https://cwe.mitre.org/data/definitions/80.html
- https://cwe.mitre.org/data/definitions/83.html
- https://cwe.mitre.org/data/definitions/84.html
- https://cwe.mitre.org/data/definitions/9.html
References
- https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b
- https://github.com/vim/vim/releases/tag/v9.2.0495
- https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c
- https://access.redhat.com/errata/RHSA-2026:38509
- https://access.redhat.com/errata/RHSA-2026:38510
- https://access.redhat.com/errata/RHSA-2026:38511
- https://access.redhat.com/errata/RHSA-2026:53371
- https://access.redhat.com/security/cve/CVE-2026-47162
- https://bugzilla.redhat.com/show_bug.cgi?id=2487964
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47162.json