CVE-2026-55895: Vim Netrw Code Injection Vulnerability (CVSS 7.8)

Technical summary

The vulnerability resides in the s:NetrwLocalRmFile() function within netrw.vim, Vim's built-in file browser plugin. When a user deletes a local file through the directory listing, the plugin constructs an Ex command by interpolating the filename directly into a string passed to :execute. The escaping routine only strips backslashes, leaving pipe characters unfiltered. A pipe (|) in a filename acts as an Ex command separator, permitting an attacker to inject arbitrary Vimscript on the same command line. From there, :call system() or :! can invoke shell commands with the privileges of the Vim process. CWE-78 (OS Command Injection) and CWE-94 (Improper Control of Generation of Code) both apply.

Business impact

For security teams, this is a lateral execution risk in environments where users routinely browse untrusted directories or handle downloads. A malicious actor could compromise a user's workstation by crafting a filename in a shared drive or archive. Because Vim is lightweight and popular among developers and system administrators, widespread deployments may exist in your infrastructure. The attack requires user interaction but is trivially triggered by normal file-browser operations, making the practical attack surface significant. Remediation is straightforward (upgrade Vim), but discovery and rollout timelines matter for large estates.

Affected systems

All Vim installations prior to version 9.2.0663 are vulnerable. The netrw plugin is distributed by default in Vim and is active out of the box. Any user who opens a directory listing and attempts to delete a file is exposed. Organizations with developer workstations, jump boxes, or shared editing environments running older Vim versions face the highest risk.

Exploitability

Exploitability is moderate-to-high. An attacker must stage a crafted filename in a location a target will browse—a shared network folder, cloud storage, downloaded tarball, or version-controlled repository. Once the user opens the directory listing in Vim and initiates a delete operation (via keyboard shortcut or menu), the malicious Vimscript runs silently. No special Vim configuration or user setup is required; the plugin runs by default. The barrier is user interaction and file staging, not authentication or privilege escalation. No public proof-of-concept exploit is known to be widespread, but the attack is straightforward to construct.

Remediation

Upgrade Vim to 9.2.0663 or later. For organizations unable to patch immediately, disable or restrict the netrw plugin by adding 'let g:loaded_netrwPlugin = 1' to the user's vimrc file, though this disables directory browsing functionality. Additionally, educate users to avoid opening directory listings from untrusted or unfamiliar sources (e.g., downloaded archives with unknown provenance) until patched. File-level access controls and monitoring for suspicious Vimscript execution may provide interim detection.

Patch guidance

Verify the Vim release notes for version 9.2.0663 or later and deploy via your standard package management (apt, yum, brew, etc.) or direct compilation if necessary. Test in a non-production environment first to confirm no local customizations or scripts depend on the old netrw behavior. Once patched, confirm the installed version with :version in Vim and document the upgrade in your change log.

Detection guidance

Monitor for Vim processes spawning unexpected child processes (shell invocations) or accessing sensitive files outside normal editing workflows. Log successful and failed Vimscript execution if your environment supports that level of visibility (e.g., through auditd on Linux). In network-based detection, look for unusual file-transfer activity followed by Vim sessions accessing those files. On endpoints, hunt for vimrc modifications that auto-load or execute external commands, a sign of post-exploitation tampering.

Why prioritize this

This vulnerability merits HIGH priority because it combines a low barrier to exploitation (user interaction only, no privilege escalation needed), a plausible real-world attack scenario (browsing shared or downloaded content), and a large installed base of Vim users in security-sensitive roles. The CVSS 3.1 score of 7.8 reflects the local attack surface and high impact (code execution). Organizations with software developers or system administrators should patch within 1–2 weeks; general user desktops within 30 days.

Risk score, explained

The CVSS v3.1 score of 7.8 (HIGH) reflects: Attack Vector = Local (user must open a malicious directory), Attack Complexity = Low (standard operations trigger the flaw), Privileges Required = None (no special Vim setup or user privilege needed), User Interaction = Required (file deletion must be initiated), Scope = Unchanged (impact is confined to the user's session/system), and all three impact metrics (Confidentiality, Integrity, Availability) scored as High (arbitrary code execution). This score appropriately captures the practical risk to end users while acknowledging that the attack is not remotely exploitable.

Frequently asked questions