vim up to 9.2.494 Directory netrw.vim NetrwBookHistSave injection

Summaryinfo

A vulnerability was found in vim up to 9.2.494. It has been rated as critical. This affects the function NetrwBookHistSave of the file runtime/pack/dist/opt/netrw/autoload/netrw.vim of the component Directory Handler. The manipulation leads to injection. This vulnerability is listed as CVE-2026-47162. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in vim up to 9.2.494. This issue affects the function NetrwBookHistSave of the file runtime/pack/dist/opt/netrw/autoload/netrw.vim of the component Directory Handler. The manipulation with an unknown input leads to a injection vulnerability. Using CWE to declare the problem leads to CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-47162 since 05/18/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1055 for this issue.

Upgrading to version 9.2.0495 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Word Processing Software

Name

• vim

Version

• 9.2.494

License

• open-source

Website

• Product: https://github.com/vim/vim/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion