Vulnerability Description
Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vim | Vim | < 9.2.0383 |
Related Weaknesses (CWE)
References
- https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fcPatch
- https://github.com/vim/vim/releases/tag/v9.2.0383Product
- https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gxPatchVendor Advisory
FAQ
What is CVE-2026-42307?
CVE-2026-42307 is a vulnerability with a CVSS score of 4.4 (MEDIUM). Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a cra...
How severe is CVE-2026-42307?
CVE-2026-42307 has been rated MEDIUM with a CVSS base score of 4.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-42307?
Check the references section above for vendor advisories and patch information. Affected products include: Vim Vim.