CVE-2026-47162: Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name
Last updated 19 June 2026
Other sources
Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.
— MITRE
Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.2.0524-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.0620-1 - Upgrade
Upgrade
Vim netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim)to a version that resolves this vulnerability.Fixed in 9.2.0495
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47162?
CVE-2026-47162 has a severity rating of high, with a CVSS score of 7.3.
How do I fix CVE-2026-47162?
To resolve CVE-2026-47162, you should update Vim to version 9.2.0495 or later.
What is CVE-2026-47162 about?
CVE-2026-47162 is a vulnerability in Vim that allows for Vimscript code injection through crafted directory names in the netrw plugin.
Who is affected by CVE-2026-47162?
Users of Vim versions prior to 9.2.0495 who utilize the netrw plugin are affected by CVE-2026-47162.
What are the potential impacts of CVE-2026-47162?
CVE-2026-47162 can lead to unauthorized code execution due to the code injection vulnerability.