Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28417.json",
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-86"
]
}[
{
"id": "CVE-2026-28417-8f358b71",
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/79348dbbc09332130f4c86045e1541d68514fcc1",
"target": {
"file": "src/version.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"146200493773228420153804765641940418619",
"36852876741637871512568938061979201383",
"23814790119827869634539044921685667516",
"194309066766747958283627467118866536045"
]
},
"signature_type": "Line"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28417.json"