CVE-2026-28417: Vim has OS Command Injection in netrw
Vim has OS Command Injection in netrw
Other sources
Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vim/netrwto a version that resolves this vulnerability.Fixed in 9.2.0073
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28417?
CVE-2026-28417 is considered a high severity vulnerability due to its potential for OS command injection.
How do I fix CVE-2026-28417?
You can fix CVE-2026-28417 by updating Vim to version 9.2.0073 or later.
What causes CVE-2026-28417?
CVE-2026-28417 is caused by a flaw in the netrw plugin that allows OS command injection through improperly handled URLs.
Which versions of Vim are affected by CVE-2026-28417?
Vim versions prior to 9.2.0073 are affected by CVE-2026-28417.
Can CVE-2026-28417 be exploited remotely?
Yes, CVE-2026-28417 can be exploited remotely if a user is convinced to open a crafted URL using the netrw plugin.