Cloudanix VulnDB

CVE-2026-28417

Medium · 4.4

CVSS

4.4

EPSS

1.5%

Published

Feb 27, 2026

CISA due date

—

The record

Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.

Affected packages

Ecosystem Package Introduced Fixed
Mageia:9 vim 0 9.2.106-1.mga9
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS vim 0 9.2.0110-150500.20.43.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS vim 0 9.2.0110-150500.20.43.1
SUSE:Linux Enterprise Micro 5.5 vim 0 9.2.0110-150500.20.43.1
SUSE:Linux Enterprise Module for Basesystem 15 SP7 vim 0 9.2.0110-150500.20.43.1
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 vim 0 9.2.0110-150500.20.43.1
SUSE:Linux Enterprise Server 15 SP5-LTSS vim 0 9.2.0110-150500.20.43.1
SUSE:Linux Enterprise Server 15 SP6-LTSS vim 0 9.2.0110-150500.20.43.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 vim 0 9.2.0110-150500.20.43.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 vim 0 9.2.0110-150500.20.43.1
openSUSE:Leap 15.6 vim 0 9.2.0110-150500.20.43.1
openSUSE:Leap 16.0 vim 0 9.2.0110-160000.1.1

Related vulnerabilities