Unrated severityNVD Advisory· Published Feb 27, 2026· Updated Mar 2, 2026
Vim has OS Command Injection in netrw
CVE-2026-28417
Description
Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.
Affected products
34- osv-coords32 versionspkg:rpm/almalinux/vim-commonpkg:rpm/almalinux/vim-datapkg:rpm/almalinux/vim-enhancedpkg:rpm/almalinux/vim-filesystempkg:rpm/almalinux/vim-minimalpkg:rpm/almalinux/vim-X11pkg:rpm/almalinux/xxdpkg:rpm/opensuse/vim&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/vim&distro=openSUSE%20Leap%2016.0pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Micro%205.2pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Micro%205.3pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Micro%205.4pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Micro%205.5pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSSpkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5pkg:rpm/suse/vim&distro=SUSE%20Linux%20Micro%206.0pkg:rpm/suse/vim&distro=SUSE%20Linux%20Micro%206.1pkg:rpm/suse/vim&distro=SUSE%20Linux%20Micro%206.2
< 2:8.0.1763-22.el8_10.1+ 31 more
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:9.1.083-6.el10_1.3
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:8.0.1763-22.el8_10.1
- (no CPE)range: < 2:9.1.083-6.el10_1.3
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-160000.1.1
- (no CPE)range: < 9.2.0110-150000.5.86.1
- (no CPE)range: < 9.2.0110-150000.5.86.1
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-150000.5.86.1
- (no CPE)range: < 9.2.0110-150000.5.86.1
- (no CPE)range: < 9.2.0110-150000.5.86.1
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-17.59.1
- (no CPE)range: < 9.2.0110-150000.5.86.1
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-160000.1.1
- (no CPE)range: < 9.2.0110-150000.5.86.1
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-150500.20.43.1
- (no CPE)range: < 9.2.0110-160000.1.1
- (no CPE)range: < 9.2.0110-17.59.1
- (no CPE)range: < 9.2.0110-1.1
- (no CPE)range: < 9.2.0110-slfo.1.1_1.1
- (no CPE)range: < 9.2.0110-160000.1.1
Patches
Vulnerability mechanics
References
3- github.com/vim/vim/commit/79348dbbc09332130f4c860mitrex_refsource_MISC
- github.com/vim/vim/releases/tag/v9.2.0073mitrex_refsource_MISC
- github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.