Executive brief
Vim is a widely used open-source text editor. A vulnerability in its built-in file explorer (netrw) allows a malicious directory name to execute hidden commands on a user's computer. If a user browses a specially crafted directory using Vim, malicious code is saved to their history file and executed the next time they use the editor, potentially leading to full system compromise or data theft.
Technical details
A Vimscript code injection vulnerability exists in the s:NetrwBookHistSave() function within the netrw plugin (autoload/netrw.vim). The root cause is the improper neutralization of single quotes when serializing browsed directory paths into the ~/.vim/.netrwhist history file. When a user navigates to a directory with a crafted name containing single quotes and Vimscript separators (e.g., |), the malicious payload is written unescaped into a 'let' assignment. This payload is subsequently executed with the user's privileges when Vim sources the history file during a later session. Exploitation requires the victim to browse a malicious directory and later restart Vim. The issue is fixed in version 9.2.0495 by using the string() function to properly escape directory paths.
Affected products
- Vim Vim < 9.2.0495
Timeline
- 2026-05-17: patched: Patch 9.2.0495 released
- 2026-05-17: advisory: GitHub Security Advisory GHSA-crm5-rh6j-2c7c published
- 2026-06-11: disclosed: CVE-2026-47162 published to NVD