Executive brief
Vim is a widely used open-source text editor. A security flaw in its built-in 'netrw' plugin, which handles remote file transfers, could allow an attacker to execute unauthorized commands on a user's computer. To exploit this, an attacker must trick a user into opening a specially crafted file path or URL (such as one starting with sftp://), potentially leading to data theft or unauthorized system changes.
Technical details
An OS command injection vulnerability exists in the netrw plugin's s:GetTempfile() function due to improper neutralization of shell metacharacters. When processing URLs (e.g., sftp:// or file://), the plugin extracts a file suffix to create a temporary file name but fails to sanitize characters following the dot. These unsanitized characters are then passed to external shell commands without proper escaping. An attacker can achieve arbitrary code execution with the privileges of the Vim process by convincing a user to open a malicious URL. The issue is addressed in Vim version 9.2.0383 by improving suffix validation.
Affected products
- Vim Vim < 9.2.0383
Timeline
- 2026-04-21: patched: Vim patch v9.2.0383 released
- 2026-05-08: disclosed: CVE-2026-42307 published