Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade vim-filesystemUpgrade vim-minimalUpgrade vim-commonUpgrade vim-enhancedUpgrade vim-X11 | Apr 13, 2026 | Apr 7, 2026 |
| Alpine Linux | — | Upgrade vim | Mar 2, 2026 | Feb 27, 2026 |
| Amazon_linux_2023 | — | Upgrade vim-minimalUpgrade vim-debugsourceUpgrade vim-filesystemUpgrade vim-enhancedUpgrade vim-default-editorUpgrade vim-debuginfoUpgrade vim-minimal-debuginfoUpgrade vim-commonUpgrade xxdUpgrade vim-enhanced-debuginfoUpgrade xxd-debuginfoUpgrade vim-data | Apr 14, 2026 | Feb 27, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Jun 2, 2026 |
| Oracle_linux | — | Upgrade vim-filesystemUpgrade vim-minimalUpgrade xxdUpgrade vim-dataUpgrade vim-X11Upgrade vim-enhancedUpgrade vim-common | Apr 22, 2026 | Feb 27, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Feb 27, 2026 |
| Redhat_linux | — | Upgrade vim-debuginfoUpgrade vim-X11Upgrade vim-filesystemUpgrade vim-enhanced-debuginfoUpgrade vim-enhancedUpgrade vim-dataUpgrade xxdUpgrade vim-debugsourceUpgrade vim-common-debuginfoUpgrade vim-minimalUpgrade vim-commonUpgrade vim-X11-debuginfoUpgrade vim-minimal-debuginfoUpgrade xxd-debuginfo | Apr 3, 2026 | Feb 27, 2026 |
| Rocky_linux | — | Upgrade vim-X11-debuginfoUpgrade vim-minimalUpgrade vim-enhanced-debuginfoUpgrade vim-debugsourceUpgrade xxdUpgrade vim-enhancedUpgrade vim-common-debuginfoUpgrade vim-X11Upgrade vim-debuginfoUpgrade xxd-debuginfoUpgrade vim-commonUpgrade vim-minimal-debuginfo | Apr 10, 2026 | Apr 9, 2026 |
| Ubuntu | — | Upgrade vim-athenaUpgrade vim-tinyUpgrade vim-nox-py2 (Ubuntu Pro)Upgrade vim-gui-common (Ubuntu Pro)Upgrade vim-runtimeUpgrade vim-runtime (Ubuntu Pro)Upgrade vim-tiny (Ubuntu Pro)Upgrade vim-athena (Ubuntu Pro)Upgrade vim-nox (Ubuntu Pro)Upgrade xxdUpgrade vim-commonUpgrade vim-noxUpgrade vimUpgrade vim (Ubuntu Pro)Upgrade vim-gtk3 (Ubuntu Pro)Upgrade vim-gtk-py2 (Ubuntu Pro)Upgrade vim-gui-commonUpgrade vim-motifUpgrade vim-gtk (Ubuntu Pro)Upgrade vim-gtk3Upgrade vim-common (Ubuntu Pro)Upgrade vim-gnome (Ubuntu Pro)Upgrade vim-athena-py2 (Ubuntu Pro)Upgrade vim-gnome-py2 (Ubuntu Pro)Upgrade vim-gtkUpgrade vim-lesstif (Ubuntu Pro)Upgrade xxd (Ubuntu Pro)Upgrade vim-gtk3-py2 (Ubuntu Pro) | Mar 19, 2026 | Feb 27, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Feb 27, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub