Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!. This vulnerability is fixed in 9.2.0663.
CVSS Details
- CVSS 4.0 Base Score: 5.7 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade vim | Jun 26, 2026 | Jun 25, 2026 |
| Amazon Linux Ami 2 | — | Upgrade vim-commonUpgrade xxdUpgrade vim-minimalUpgrade vim-enhancedUpgrade vim-filesystemUpgrade vim-debuginfoUpgrade vim-X11Upgrade vim-data | Jul 22, 2026 | Jul 22, 2026 |
| Amazon_linux_2023 | — | Upgrade vim-minimalUpgrade vim-dataUpgrade xxd-debuginfoUpgrade vim-enhanced-debuginfoUpgrade vim-minimal-debuginfoUpgrade vim-enhancedUpgrade xxdUpgrade vim-commonUpgrade vim-debuginfoUpgrade vim-debugsourceUpgrade vim-filesystemUpgrade vim-default-editor | Jul 21, 2026 | Jun 25, 2026 |
| Debian | — | Upgrade vim | Nov 2, 2026 | Jun 25, 2026 |
| Redhat_linux | — | — | Jul 17, 2026 | Jun 25, 2026 |
| Ubuntu | — | Upgrade vim-gtk-py2 (Ubuntu Pro)Upgrade vim-common (Ubuntu Pro)Upgrade vim-athena-py2 (Ubuntu Pro)Upgrade vim-gnome-py2 (Ubuntu Pro)Upgrade vim-gtk3Upgrade vimUpgrade vim-gtkUpgrade vim-tinyUpgrade xxd (Ubuntu Pro)Upgrade vim-gtk3-py2 (Ubuntu Pro)Upgrade vim-commonUpgrade xxdUpgrade vim-gui-common (Ubuntu Pro)Upgrade vim-motifUpgrade vim (Ubuntu Pro)Upgrade vim-lesstif (Ubuntu Pro)Upgrade vim-gtk (Ubuntu Pro)Upgrade vim-gtk3 (Ubuntu Pro)Upgrade vim-tiny (Ubuntu Pro)Upgrade vim-athenaUpgrade vim-gnome (Ubuntu Pro)Upgrade vim-noxUpgrade vim-runtime (Ubuntu Pro)Upgrade vim-athena (Ubuntu Pro)Upgrade vim-runtimeUpgrade vim-nox-py2 (Ubuntu Pro)Upgrade vim-nox (Ubuntu Pro)Upgrade vim-gui-common | Jul 5, 2026 | Jul 2, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 6, 2026 | Jun 25, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub