CVE-2026-47162

What it actually does

Vim versions prior to 9.2.0495 contain a Vimscript code injection flaw in the bundled netrw plugin. When netrw saves browsed directory history, it writes filesystem-derived directory paths into the user history file ~/.vim/.netrwhist as single-quoted Vimscript strings. A directory name containing an embedded single quote can break out of that string literal and inject arbitrary Vimscript. When the history file is later sourced by Vim/netrw, the injected Vimscript executes in the context of the user running Vim, including commands that invoke the operating system through system(), :!, or related Vimscript execution primitives.

Why it matters to the business

Successful exploitation can turn normal use of Vim to browse a crafted directory into code execution on a developer workstation, server shell session, or administrative host. The attacker’s code runs with the privileges of the Vim user, which can lead to credential theft, source-code tampering, malware installation, persistence, lateral movement, or disruption of development and operations workflows. The issue is not currently listed in CISA KEV and the EPSS score is low, indicating no strong public signal of broad exploitation, but the impact is high where Vim is used on shared directories, unpacked archives, repositories, network filesystems, or attacker-controlled project trees.

How an attack unfolds

An attacker first needs a way to cause a victim to browse a filesystem location containing a maliciously named directory. This can occur through a downloaded archive, a cloned repository, a shared project folder, a network-mounted filesystem, or another path where the attacker can influence directory names. The malicious directory name includes a single quote and Vimscript payload designed to escape the quoted string that netrw writes into ~/.vim/.netrwhist. When the victim uses Vim’s netrw functionality to browse that directory, netrw serializes the path into the history file without correctly escaping the embedded quote. On a subsequent load or sourcing of the netrw history file, Vim interprets the injected content as Vimscript rather than as data. The payload can then execute arbitrary editor commands or spawn operating-system commands, giving the attacker code execution as the Vim user.

How to fix it

Upgrade Vim to version 9.2.0495 or later, which patches netrw path serialization by properly handling embedded single quotes. Where operating system packages are used, install the vendor-provided Vim update that includes the fix rather than relying only on the upstream version number. As a temporary mitigation, avoid using netrw to browse untrusted repositories, archives, shared directories, or network filesystems; remove or restrict loading of the netrw plugin where not needed; and inspect or delete ~/.vim/.netrwhist if exposure is suspected. Because the payload is stored in a per-user history file, remediation should include both patching Vim and checking user home directories for malicious netrw history entries.

How to confirm the fix worked

Confirm that `vim --version` reports version 9.2.0495 or later, or that the installed vendor package changelog explicitly includes the CVE-2026-47162 fix. Verify that the runtime netrw plugin is supplied by the patched package and is not shadowed by an older user-local or site-local copy. On representative systems, inspect ~/.vim/.netrwhist for netrw history entries containing suspicious embedded single quotes, Vimscript command separators, or calls to shell-execution functions. If a test environment is available, create a harmless directory name containing a single quote and verify that netrw records it safely as data rather than producing executable Vimscript in the history file.

Typical attack path

1. Attacker creates or controls a directory with a name containing Vimscript metacharacters, especially an embedded single quote and command payload.
2. Attacker delivers the directory through a repository, archive, shared folder, network share, or other attacker-influenced filesystem location.
3. Victim opens Vim and uses netrw to browse into or around the crafted directory.
4. Vulnerable netrw saves the browsed path into ~/.vim/.netrwhist without escaping the embedded single quote.
5. The malformed history entry becomes executable Vimscript in the history file.
6. When Vim/netrw later sources ~/.vim/.netrwhist, the injected Vimscript executes.
7. Payload runs editor-level actions or operating-system commands as the current Vim user.

How to detect it

To determine whether exploitation already occurred, inspect per-user netrw history files, primarily ~/.vim/.netrwhist, for entries that look like path history but contain executable Vimscript. Focus on `let g:netrw_dirhist_` lines containing embedded single quotes followed by command separators, shell execution, function calls, or source/execute directives. Review endpoint process telemetry for Vim processes launching shells or network utilities, including `/bin/sh`, `/bin/bash`, `zsh`, `cmd.exe`, `powershell.exe`, `curl`, `wget`, `python`, `perl`, `ruby`, `nc`, or `ncat`. Correlate suspicious Vim child processes with file access to ~/.vim/.netrwhist and with recent extraction or cloning of untrusted directories. Check shell history, editor swap files, recently modified startup files such as ~/.vimrc and plugin directories, and persistence locations for follow-on activity. In EDR/SIEM, useful pivots include process parent names `vim`, `gvim`, `view`, or `vimdiff`, command lines containing shell metacharacters, and file reads or writes of `.netrwhist` shortly before unexpected command execution.

• ~/.vim/.netrwhist
• let g:netrw_dirhist_
• g:netrw_dirhistmax
• system(
• call system(
• silent !
• :!
• execute(
• source
• runtime
• /bin/sh
• /bin/bash
• cmd.exe
• powershell.exe
• curl
• wget
• nc
• ncat
• python
• perl
• ruby
• vim -> /bin/sh
• vim -> /bin/bash
• gvim -> /bin/sh
• gvim -> powershell.exe
• let g:netrw_dirhist_.*'.*system(
• let g:netrw_dirhist_.*'.*:!
• let g:netrw_dirhist_.*'.*execute(

What your security team should do

• Prioritize patching Vim to 9.2.0495 or the equivalent fixed vendor package on developer workstations, build systems, bastion hosts, and administrative servers where Vim is used interactively.
• Search user home directories for suspicious ~/.vim/.netrwhist entries before or during rollout, especially on systems that handle untrusted code, archives, shared folders, or network-mounted paths.
• Temporarily disable or restrict netrw usage for users who regularly inspect untrusted filesystem content until patching is complete.
• Educate developers and administrators that opening or browsing untrusted project trees in editor file browsers can trigger code execution when editor plugins parse filesystem names unsafely.
• Add detection logic for Vim spawning unexpected shells, curl/wget, scripting interpreters, or other child processes shortly after sourcing netrw history.
• Review endpoint telemetry for suspicious child processes launched by vim, gvim, view, or related editor binaries.