REDHAT-BUG-2443455: Command Injection

Q: Who is realistically exposed to this issue?

Users who open attacker-controlled URLs in Vim are exposed, particularly URLs handled by the bundled netrw plugin such as scp:// URLs. Successful exploitation runs shell commands with the privileges of the Vim process.

Q: What does an attacker need to do to exploit it?

An attacker needs to induce a user to open a crafted URL in Vim. The provided example uses the scp:// protocol handler, which is processed by netrw.

Q: Which Vim versions are affected?

Vim versions prior to 9.2.0073 are affected. Version 9.2.0073 fixes the issue.

Published Feb 27, 2026

Updated

Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.

Affected Software

1 affected component

vim Vim<9.2.0073

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade vim to a version that resolves this vulnerability.
Fixed in 9.2.0073

Event History

Feb 27, 2026

Data Sourced

via Red Hat·10:02 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

Users who open attacker-controlled URLs in Vim are exposed, particularly URLs handled by the bundled netrw plugin such as scp:// URLs. Successful exploitation runs shell commands with the privileges of the Vim process.

What does an attacker need to do to exploit it?