CVE-2026-55895

Katalog CVE

CVSS 7.8 · High EPSS 0,23%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada vim. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!. This vulnerability is fixed in 9.2.0663.

Rincian

Terbit di NVD

25 Juni 2026

Terakhir diubah

26 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 12,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vim/vim/security/advisories/GHSA-vhh8-v6wx-hjjh advisory vendor
• https://github.com/vim/vim/commit/55bc757a5d436e59d50fe43f7cda94b118f86cb2 patch
• https://github.com/vim/vim/releases/tag/v9.2.0663 product