CVE-2026-42307: Vim: OS Command Injection in netrw

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-08 · updated 2026-07-24
Weakness: CWE-78

Description

Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.

Affected products

vim/vim: before 9.2.0383 — fixed in 9.2.0383

How to fix

Upgrade to a fixed version: vim/vim 9.2.0383. Check the vendor advisory for mitigations.

References

https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc
https://github.com/vim/vim/releases/tag/v9.2.0383
https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gx

Get alerted when CVE-2026-42307 or the next vulnerability affects your stack