Vulnerability · Published Feb 27, 2026 · Assigned by GitHub_M
CVE-2026-28417Vim has OS Command Injection in netrw
Medium 4.4
In plain English
A medium-severity security flaw in vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | vim-X11 | 2:8.0.1763-22.el8_10.1 | ALSA-2026:6915 |
| AlmaLinux:9 | vim-X11 | 2:8.2.2637-23.el9_7.2 | ALSA-2026:8259 |
| AlmaLinux:8 | vim-common | 2:8.0.1763-22.el8_10.1 | ALSA-2026:6915 |
| AlmaLinux:9 | vim-common | 2:8.2.2637-23.el9_7.2 | ALSA-2026:8259 |
| AlmaLinux:10 | vim-data | 2:9.1.083-6.el10_1.3 | ALSA-2026:7711 |
| AlmaLinux:8 | vim-enhanced | 2:8.0.1763-22.el8_10.1 | ALSA-2026:6915 |
| AlmaLinux:9 | vim-enhanced | 2:8.2.2637-23.el9_7.2 | ALSA-2026:8259 |
| AlmaLinux:10 | vim-filesystem | 2:9.1.083-6.el10_1.3 | ALSA-2026:7711 |
| AlmaLinux:8 | vim-filesystem | 2:8.0.1763-22.el8_10.1 | ALSA-2026:6915 |
| AlmaLinux:9 | vim-filesystem | 2:8.2.2637-23.el9_7.2 | ALSA-2026:8259 |
| AlmaLinux:8 | vim-minimal | 2:8.0.1763-22.el8_10.1 | ALSA-2026:6915 |
| AlmaLinux:9 | vim-minimal | 2:8.2.2637-23.el9_7.2 | ALSA-2026:8259 |
| Alpine:v3.23 | vim | 9.2.0078-r0 | ALPINE-CVE-2026-28417 |
| Alpine:v3.24 | vim | 9.2.0078-r0 | ALPINE-CVE-2026-28417 |
| Debian:12 | vim | no fix listed | DEBIAN-CVE-2026-28417 |
| Debian:13 | vim | 2:9.1.1230-2+deb13u1 | DEBIAN-CVE-2026-28417 |
| Debian:14 | vim | 2:9.2.0119-1 | DEBIAN-CVE-2026-28417 |
| Rocky Linux:10 | vim | 2:9.1.083-6.el10_1.3 | RLSA-2026:7711 |
| Rocky Linux:8 | vim | 2:8.0.1763-22.el8_10.1 | RLSA-2026:6915 |
| Rocky Linux:9 | vim | 2:8.2.2637-23.el9_7.2 | RLSA-2026:8259 |
| Ubuntu:22.04:LTS | vim | 2:8.2.3995-1ubuntu2.35 | USN-8657-1 |
| Ubuntu:22.04:LTS | vim | 2:8.2.3995-1ubuntu2.26 | UBUNTU-CVE-2026-28417 |
| Ubuntu:24.04:LTS | vim | 2:9.1.0016-1ubuntu7.19 | USN-8657-1 |
| Ubuntu:24.04:LTS | vim | 2:9.1.0016-1ubuntu7.10 | UBUNTU-CVE-2026-28417 |
| Ubuntu:25.10 | vim | 2:9.1.0967-1ubuntu6.1 | UBUNTU-CVE-2026-28417 |
| Ubuntu:26.04:LTS | vim | 2:9.1.2141-1ubuntu2 | UBUNTU-CVE-2026-28417 |
| Ubuntu:26.04:LTS | vim | 2:9.1.2141-1ubuntu4.8 | USN-8657-1 |
Affected products (as reported)
Weakness: CWE-86 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N