CVE-2026-28417 Vim has OS Command Injection in netrw

What is CVE-2026-28417?

CVE-2026-28417 is a medium-severity command injection vulnerability in Vim Vim, published on 27 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.

Weakness: CWE-78, CWE-86

Which versions are affected by CVE-2026-28417?

It affects 1 product.

Products include Vim Vim.

How do I fix CVE-2026-28417?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-28417 being exploited?

There is no known exploitation of CVE-2026-28417 in the wild and no public exploit code.

Other vulnerabilities in Vim Vim

• CVE-2020-20703 Memory corruption in n/a Critical 9.8
• CVE-2017-6349 Integer overflow in n/a Critical 9.8
• CVE-2017-6350 Integer overflow in n/a Critical 9.8
• CVE-2017-5953 Integer overflow in n/a Critical 9.8
• CVE-2008-3075 Command injection in n/a Critical 9.3

All Vim Vim vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-28417, AZL-78497, BELL-CVE-2026-28417, DEBIAN-CVE-2026-28417, ECHO-180e-0061-390d, GHSA-m3xh-9434-g336 and 5 more.