CVE-2026-42307
MediumCVSS 4.4Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
Vim before version 9.2.0383 has an OS command injection vulnerability in the netrw standard plugin via a crafted URL (e.g., sftp:// or file://). User interaction is required.
Risk Assessment
An attacker can execute arbitrary system commands under the Vim user's account, potentially leading to system compromise.
Recommendation
Update Vim to version 9.2.0383 or later.
Original NVD description (English source)
Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.