Vim Vulnerability: Code Injection Risk in Netrw Plugin
Summary
ALPINE-CVE-2026-55895: Vim is an open source, command line text editor. Affects vim versions < 9.2.0854-r0. Fixed in 9.2.0854-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a widely used open-source command line text editor known for its efficiency and extensibility. It supports various plugins, enhancing its functionality for tasks such as file management. The Netrw plugin, included in Vim, allows users to browse and manipulate files over various protocols. However, a vulnerability in this plugin can lead to serious security risks when handling filenames derived from directory listings.
Vulnerability Detail
Prior to version 9.2.0663, Vim's Netrw plugin contained a code injection vulnerability in the function s:NetrwLocalRmFile(). This issue arises when a user attempts to delete a local file from the browser. The filename, which is derived from the buffer's directory listing, is interpolated into an Ex command line passed to :execute. The vulnerability occurs because only the backslash character is escaped, allowing a crafted filename containing a bar (|) to terminate the intended command. This can lead to the execution of arbitrary Vimscript, including potentially harmful shell commands via :call system() and :!. The severity of this vulnerability is reflected in its CVSS score of 7.8, indicating a high risk to users.
How To Fix
Minimum fixed version
9.2.0854-r0
This is the first release that contains the fix.
sudo apk add --upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid executing commands that involve filenames derived from directory listings until the package is updated. Additionally, users should validate filenames before executing commands to prevent potential exploitation.
Conclusion
The Vim vulnerability in the Netrw plugin poses a significant risk due to its potential for code injection. Users are strongly advised to update to the latest version to mitigate this risk. Regular monitoring and updates are essential to maintain security in open-source software.
See every vulnerability recorded for vim →
FAQ
The vulnerability is a code injection risk in the Netrw plugin that allows crafted filenames to execute arbitrary commands.
You can check your Vim version by running 'vim --version' in the terminal. If it is below 9.2.0663, it is vulnerable.
Exploitation of this vulnerability can lead to unauthorized command execution, potentially compromising the system.
Yes, tools like Vulert can monitor your project for open-source vulnerabilities using a manifest file like package-lock.json.
Detailed information can be found in the CVE database under CVE-2026-55895 or by visiting Vulert's website.
References
Related vulnerabilities
Recent vulnerabilities recorded for vim.
