Medium severity4.4NVD Advisory· Published Feb 27, 2026· Updated Jun 17, 2026
CVE-2026-28417
CVE-2026-28417
Description
Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.
Affected products
36- osv-coords32 versionspkg:rpm/suse/vim&distro=SUSE%20Linux%20Micro%206.2pkg:rpm/almalinux/xxdpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6pkg:rpm/opensuse/vim&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/vim&distro=openSUSE%20Leap%2016.0pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Micro%205.3pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Micro%205.4pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Micro%205.2pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5pkg:rpm/suse/vim&distro=SUSE%20Linux%20Micro%206.0pkg:rpm/suse/vim&distro=SUSE%20Linux%20Micro%206.1pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Micro%205.5pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7pkg:rpm/almalinux/vim-X11pkg:rpm/almalinux/vim-commonpkg:rpm/almalinux/vim-enhancedpkg:rpm/almalinux/vim-filesystempkg:rpm/almalinux/vim-minimalpkg:rpm/almalinux/vim-data
< 9.2.0110-160000.1.1+ 31 more
- (no CPE)range: < 9.2.0110-160000.1.1
- (no CPE)range: < 2:9.1.083-6.el10_1.3
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-160000.1.1
- (no CPE)range: < 9.2.0110-150000.5.86.1
- (no CPE)range: < 9.2.0110-150000.5.86.1
- (no CPE)range: < 9.2.0110-150000.5.86.1
- (no CPE)range: < 9.2.0110-150000.5.86.1
- (no CPE)range: < 9.2.0110-150000.5.86.1
- (no CPE)range: < 9.2.0110-150000.5.86.1
- (no CPE)range: < 9.2.0110-150000.5.86.1
- (no CPE)range: < 9.2.0110-17.59.1
- (no CPE)range: < 9.2.0110-17.59.1
- (no CPE)range: < 9.2.0110-1.1
- (no CPE)range: < 9.2.0110-slfo.1.1_1.1
- (no CPE)range: < 9.2.0110-160000.1.1
- (no CPE)range: < 9.2.0110-160000.1.1
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:9.1.083-6.el10_1.3
Patches
Vulnerability mechanics
References
4- www.openwall.com/lists/oss-security/2026/02/27/6nvdMailing ListPatchThird Party Advisory
- github.com/vim/vim/commit/79348dbbc09332130f4c860nvdPatch
- github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336nvdPatchVendor Advisory
- github.com/vim/vim/releases/tag/v9.2.0073nvdRelease Notes
News mentions
0No linked articles in our index yet.