CVE-2026-42307: Vim: OS Command Injection in netrw
Last updated 13 May 2026
Other sources
Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.2.0461-1Fixed in 2:9.2.0524-1 - Upgrade
Upgrade
Vim (netrw standard plugin)to a version that resolves this vulnerability.Fixed in 9.2.0383
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42307?
CVE-2026-42307 is considered a high severity OS command injection vulnerability in Vim's netrw plugin.
How do I fix CVE-2026-42307?
To mitigate CVE-2026-42307, users should upgrade to Vim version 9.2.0383 or later.
What causes CVE-2026-42307?
CVE-2026-42307 is caused by improper handling of user-supplied URLs in the netrw plugin, leading to potential OS command injection.
Which versions of Vim are affected by CVE-2026-42307?
CVE-2026-42307 affects all Vim versions prior to 9.2.0383.
Is CVE-2026-42307 a remote exploitation risk?
Yes, CVE-2026-42307 can be exploited remotely by tricking a user into opening a malicious URL.