CVE-2026-55895CWE-78CWE-94

Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename

Medium · published June 25, 2026

CVSS v4.0
5.7
EPSS
0%
Percentile
12.6
In the wild
Unconfirmed
What it is

Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!. This vulnerability is fixed in 9.2.0663.

The record
Technical detail
CVSS v4.0
5.7 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
EPSS
0.00226 · 12.6th percentile
Weaknesses
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-06-25T15:31Z
EPSS history
Timeline
  • 25 JUN 15:31Z
    Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename
    cvelistv5