VulnerabilityAnalyzed

CVE-2026-42307

Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim.

MEDIUM 4.4EPSS 0.77%

Does this matter?

Lower severity and a low EPSS score (0.77%). Track it; it rarely justifies an emergency change on its own.

Description

Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.

CVSS 3.1: 4.4 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS: 0.77% probability · 54th percentile
CISA KEV: Not listed
Weakness: CWE-78
Affected: vim/vim
Source: security-advisories@github.com

References

https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fcPatch
https://github.com/vim/vim/releases/tag/v9.2.0383Product
https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gxPatch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.