CVE-2026-42307

What it actually does

Vim versions prior to 9.2.0383 include a vulnerable netrw standard plugin path that can pass attacker-controlled URL content into operating-system command execution. The issue requires user interaction: a user must open or otherwise cause Vim to process a crafted URL using affected handlers such as sftp:// or file://. Successful exploitation executes arbitrary shell commands as the user running Vim, not as a remote unauthenticated service account. The likely impact is limited to the privileges and environment of that Vim process, including access to files, credentials, SSH keys, editor buffers, and network resources available to that user.

Why it matters to the business

This vulnerability can turn a seemingly harmless request to open a file or link in Vim into code execution on a developer, administrator, or operations workstation. Although the CVSS score is moderate, the affected software is widely deployed on Unix-like systems and often used by privileged technical users, so exploitation could lead to theft of source code, secrets, SSH keys, or modification of local files. EPSS is currently low and stable, the vulnerability is not in CISA KEV, and no mature public exploitation is indicated, but organizations should still patch because exploitation can be delivered through phishing, documentation, tickets, repositories, or pasted commands that induce a user to open a crafted URL.

How an attack unfolds

An attacker first identifies a target likely to use Vim or gVim and prepares a malicious URL that is interpreted by the bundled netrw plugin. The attacker then delivers that URL through a channel that encourages the victim to open it in Vim, such as a README, issue tracker, chat message, script output, copied terminal command, email, or repository content. When the victim opens the crafted sftp:// or file:// URL in a vulnerable Vim version, netrw processes the URL and unsafely reaches an operating-system command execution path. The injected command runs with the same permissions as the Vim process. From there, the attacker may read local files, collect SSH keys or tokens, alter project files, establish persistence in user startup files, or launch follow-on tooling, depending on the user’s privileges and endpoint controls.

How to fix it

Upgrade Vim to version 9.2.0383 or later. Where Vim is provided by an operating-system distribution, install the vendor’s security update even if the displayed upstream version appears older, because some vendors backport patches. If immediate upgrading is not possible, reduce exposure by disabling or restricting the netrw plugin where operationally feasible, avoiding use of Vim to open untrusted sftp:// or file:// URLs, and using endpoint controls to alert on or block unexpected child shell processes spawned by vim or gvim. Treat workstations and administrative systems as higher priority because exploitation runs in the context of the interactive user.

How to confirm the fix worked

Confirm that installed Vim packages are patched to upstream version 9.2.0383 or to a distribution release that explicitly includes the fix for this vulnerability. Validate with package-manager metadata, vendor advisories, and `vim --version` or equivalent inventory data. On systems where plugins are managed separately, confirm the bundled netrw plugin was updated with the patched Vim package. For mitigation validation, confirm that netrw is disabled or restricted where required and that opening untrusted sftp:// or file:// URLs is blocked by policy or workflow. In an isolated test system only, use a benign non-destructive verification case and monitor that Vim does not spawn unexpected shell or utility child processes while processing such URLs.

Typical attack path

1. Prepare a crafted URL targeting the vulnerable netrw URL-handling path in Vim before version 9.2.0383.
2. Deliver the URL to a user through phishing, chat, documentation, a repository, a support ticket, or another workflow where opening URLs in Vim is plausible.
3. Convince or induce the user to open the crafted sftp:// or file:// URL with Vim or gVim.
4. Trigger netrw processing of the attacker-controlled URL.
5. Execute an arbitrary shell command as the user running Vim.
6. Use the user’s local access to read files, steal credentials or SSH material, modify project content, or run additional commands.

How to detect it

Look for evidence that Vim or gVim spawned unexpected child processes, especially shells and command-line tools, shortly after a user opened an sftp:// or file:// URL. Useful sources include EDR process telemetry, Sysmon process creation events, Linux auditd execve logs, shell history, terminal session recording, command-line logging, and file access telemetry for Vim history files such as ~/.viminfo. Investigate process trees where vim, gvim, vi, view, or rvim launches sh, bash, zsh, dash, fish, cmd.exe, powershell.exe, python, perl, ruby, curl, wget, nc, ncat, ssh, scp, or chmod. Review Vim history, recently opened files, project documentation, issue text, chat logs, and shell history for suspicious sftp:// or file:// URLs containing shell metacharacters, command substitutions, encoded separators, or unusual quoting. Because the executed command is attacker-controlled, there are no universal network or file indicators; detection should focus on parent-child process relationships, suspicious URL strings, and post-exploitation activity such as credential file access, outbound connections, or modifications to shell startup files.

• ParentImage=vim ChildImage=sh
• ParentImage=vim ChildImage=bash
• ParentImage=vim ChildImage=zsh
• ParentImage=vim ChildImage=dash
• ParentImage=vim ChildImage=fish
• ParentImage=gvim ChildImage=sh
• ParentImage=gvim ChildImage=bash
• ParentImage=vi ChildImage=sh
• ParentImage=view ChildImage=sh
• ParentImage=rvim ChildImage=sh
• vim --cmd
• gvim --cmd
• ~/.viminfo
• ~/.vim/plugin/netrwPlugin.vim
• /usr/share/vim/vim*/plugin/netrwPlugin.vim
• /usr/share/vim/vim*/autoload/netrw.vim
• sftp://.*[;|`$()]
• file://.*[;|`$()]
• sftp://.*%3b
• sftp://.*%7c
• file://.*%3b
• file://.*%7c

What your security team should do

• Prioritize patching developer workstations, administrator jump hosts, build systems, and servers where interactive Vim use occurs; upgrade to Vim 9.2.0383 or a vendor-patched equivalent.
• Add endpoint detection for vim or gvim spawning shells, scripting engines, download tools, or networking utilities, especially immediately after opening URLs.
• Warn technical users not to open untrusted sftp:// or file:// links in Vim from tickets, chats, emails, repositories, or copied terminal snippets until patched.
• Review recent endpoint telemetry for suspicious child processes of vim, gvim, vi, view, or rvim, with attention to commands that access credentials, SSH keys, source repositories, or external network destinations.
• If patching is delayed, consider disabling the netrw plugin or blocking risky URL-opening workflows in Vim for high-risk user groups.
• Track vendor security advisories for operating-system packages because fixed builds may use backported patches rather than the upstream 9.2.0383 version string.