AZL-91104
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91104.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-91104
- Upstream
- Published
- 2026-06-25T16:16:41Z
- Modified
- 2026-08-28T17:48:12.000942658Z
- Summary
- CVE-2026-55895 affecting package vim for versions less than 9.2.0735-1
- Details
-
Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!. This vulnerability is fixed in 9.2.0663.
- References