CVE-2026-55895: Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename
Last updated 2 July 2026
Other sources
Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!. This vulnerability is fixed in 9.2.0663.
— NVD
Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.0735-1 - Upgrade
Upgrade
Vim (netrw plugin)to a version that resolves this vulnerability.Fixed in 9.2.0663 - Compensating control
If you cannot upgrade immediately, avoid deleting local files from netrw (netrw browser) when filenames may be attacker-controlled, since a crafted filename can inject Vimscript through s:NetrwLocalRmFile() in netrw.vim.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55895?
CVE-2026-55895 has a medium severity rating of 5.7 according to the CVSS scoring system.
How do I fix CVE-2026-55895?
To fix CVE-2026-55895, update Vim to version 9.2.0663 or later where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-55895?
CVE-2026-55895 is a code injection vulnerability specifically affecting Vim's netrw plugin.
What component of Vim is affected by CVE-2026-55895?
CVE-2026-55895 affects the s:NetrwLocalRmFile() function in the netrw plugin of Vim.
Can CVE-2026-55895 lead to remote code execution?
CVE-2026-55895 could potentially allow for OS command injection through crafted filenames, possibly leading to remote code execution.