High 7.3Published Jun 11, 2026

CVE-2026-47162Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name

Updated under an hour ago (Oct 28, 2026, 5:50 AM ET)

Does this affect you?

It affects vim and 7 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for vim

Exploited in the last 30 days

Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.

CVSS: 7.3 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-74, CWE-94, CWE-140
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Modified
Record last updated: Sep 18, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

vim vim vim:vim (from the name)	before 9.2.0495	CNA record
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux	from 2:9.1.083-9.el10_2.7 not affected	CISA ADP
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support redhat:enterprise_linux_eus	from 2:9.1.083-5.el10_0.4 not affected	CISA ADP
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support redhat:rhel_els	from 2:7.4.629-8.el7_9.2 not affected	CISA ADP
Red Hat Red Hat OpenShift Container Platform 4.22 redhat:openshift	from 4.22.9.8.202608130832-0 not affected	CISA ADP
Red Hat Red Hat Insights proxy 1.5 redhat:insights_proxy	from 1786433656 not affected	CISA ADP
Red Hat Red Hat Update Infrastructure 5 redhat:rhui	from 1787241211 not affected	CISA ADP
Red Hat Red Hat Hardened Images redhat:hummingbird	1	CISA ADP
vim vim vim:vim	before 9.2.0495	NVD

References

References

https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c	x-refsource-confirm, vendor-advisory
https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b	x-refsource-misc, patch
https://github.com/vim/vim/releases/tag/v9.2.0495	x-refsource-misc, product
https://access.redhat.com/errata/RHSA-2026:38509
https://access.redhat.com/errata/RHSA-2026:38510
https://access.redhat.com/errata/RHSA-2026:38511
https://access.redhat.com/errata/RHSA-2026:53371
https://access.redhat.com/errata/RHSA-2026:54769
https://access.redhat.com/errata/RHSA-2026:55431
https://access.redhat.com/errata/RHSA-2026:58981
1–10 of 14

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.