By weakness (CWE)

CWE-140: related vulnerabilities

CVEs classified under CWE-140. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

1 published vulnerability

• CVE-2026-47162HIGH 8.8

  Vim, the popular open-source text editor, contains a code injection vulnerability in its netrw file browser plugin. When you browse directories in Vim, it saves a history of the paths you've visited to a file called .netrwhist. An attacker can craft a malicious directory name containing special characters that, when saved to this history file, breaks out of the intended string format and tricks Vim into executing arbitrary commands the next time you open the editor. This could allow an attacker to run malicious code on your system if you cd into or browse a directory with a carefully crafted name. The vulnerability is fixed in Vim version 9.2.0495 and later.