Vulnerability · Published Jun 11, 2026 · Assigned by GitHub_M

CVE-2026-47162Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name

High 7.3

In plain English

A high-severity injection in vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 80.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:10	vim-X11	2:9.1.083-9.el10_2.7	ALSA-2026:38509
AlmaLinux:8	vim-X11	2:8.0.1763-27.el8_10	ALSA-2026:38510
AlmaLinux:9	vim-X11	2:8.2.2637-26.el9_8.10	ALSA-2026:38511
AlmaLinux:10	vim-common	2:9.1.083-9.el10_2.7	ALSA-2026:38509
AlmaLinux:8	vim-common	2:8.0.1763-27.el8_10	ALSA-2026:38510
AlmaLinux:9	vim-common	2:8.2.2637-26.el9_8.10	ALSA-2026:38511
AlmaLinux:10	vim-data	2:9.1.083-9.el10_2.7	ALSA-2026:38509
AlmaLinux:10	vim-enhanced	2:9.1.083-9.el10_2.7	ALSA-2026:38509
AlmaLinux:8	vim-enhanced	2:8.0.1763-27.el8_10	ALSA-2026:38510
AlmaLinux:9	vim-enhanced	2:8.2.2637-26.el9_8.10	ALSA-2026:38511
AlmaLinux:10	vim-filesystem	2:9.1.083-9.el10_2.7	ALSA-2026:38509
AlmaLinux:8	vim-filesystem	2:8.0.1763-27.el8_10	ALSA-2026:38510
AlmaLinux:9	vim-filesystem	2:8.2.2637-26.el9_8.10	ALSA-2026:38511
AlmaLinux:10	vim-minimal	2:9.1.083-9.el10_2.7	ALSA-2026:38509
AlmaLinux:8	vim-minimal	2:8.0.1763-27.el8_10	ALSA-2026:38510
AlmaLinux:9	vim-minimal	2:8.2.2637-26.el9_8.10	ALSA-2026:38511
AlmaLinux:10	xxd	2:9.1.083-9.el10_2.7	ALSA-2026:38509
Debian:12	vim	no fix listed	DEBIAN-CVE-2026-47162
Debian:13	vim	2:9.1.1230-2+deb13u1	DEBIAN-CVE-2026-47162
Debian:14	vim	2:9.2.0524-1	DEBIAN-CVE-2026-47162
Rocky Linux:10	vim	2:9.1.083-9.el10_2.7	RLSA-2026:38509
Rocky Linux:8	vim	2:8.0.1763-27.el8_10	RLSA-2026:38510
Rocky Linux:9	vim	2:8.2.2637-26.el9_8.10	RLSA-2026:38511
Ubuntu:22.04:LTS	vim	2:8.2.3995-1ubuntu2.32	UBUNTU-CVE-2026-47162
Ubuntu:24.04:LTS	vim	2:9.1.0016-1ubuntu7.16	UBUNTU-CVE-2026-47162
Ubuntu:25.10	vim	2:9.1.0967-1ubuntu6.7	UBUNTU-CVE-2026-47162
Ubuntu:26.04:LTS	vim	2:9.1.2141-1ubuntu4.5	UBUNTU-CVE-2026-47162

Affected products (as reported)

Vendor	Product	Versions
vim	vim	< 9.2.0495

Weakness: CWE-74, CWE-94, CWE-140 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c x_refsource_CONFIRM
https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0495 x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-47162 vdb-entry, x_refsource_REDHAT
RHBZ#2487964 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47162.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:68711 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54769 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55431 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38509 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38510 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38511 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53371 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:58981 vendor-advisory, x_refsource_REDHAT