Skip to content
fr Sign in
7.3 High

CVE-2026-47162 Vim is an open source, command line text editor

Description

Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.

Affected products and versions

Product Affected versions Fixed in
vim 9.2 earliest → < 9.2.0495 9.2.0495
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 6 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat Insights proxy 1.5 1786433656 earliest → < 1786433656 1786433656
Red Hat Enterprise Linux 10.0 Extended Update Support Versions not published
Show the 4 other branches
Product Affected versions Fixed in
Red Hat OpenShift Container Platform 4.22 4.22 earliest → < 4.22.9.8.202608130832-0 4.22.9.8.202608130832-0
Red Hat Update Infrastructure 5 1787241260 earliest → < 1787241260 1787241260
Red Hat Enterprise Linux 7 Extended Lifecycle Support Versions not published
Red Hat Hardened Images Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of vim

The 73 CVEs of vim →
CVE-2026-43961 Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution 7.8 High CVE-2026-73073 Vim is an open source, command line text editor 7.1 High CVE-2026-73078 Vim is an open source, command line text editor 8.6 High CVE-2026-73077 Vim is an open source, command line text editor 8.4 High
Track this CVE