Vim s:NetrwBookHistSave Buffer Overflow

The vulnerability of the s:NetrwBookHistSave function in the Vim text editor is related to improper elimination of separators. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

CLSA-2026-1782138605 vim: Fix of 2 CVEs

CVE-2026-47162: fix code injection via NetrwBookHistSave by quoting the directory name with string...

vim security update

9.1.083-9.0.1.el102.7 - Remove upstream references Orabug: 31197557 2:9.1.083-9.7 - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete 2:9.1.083-9.6 - RHEL-185867 CVE-2026-47167 vim: Code...

CLSA-2026-1782139332 vim: Fix of CVE-2026-47162

CVE-2026-47162: fix code injection via NetrwBookHistSave by quoting the directory name with string...

CLSA-2026-1781552300 vim: Fix of CVE-2026-47162

CVE-2026-47162: fix code injection in netrw via a crafted directory name serialized into .netrwhist by NetrwBookHistSave using string to safely encode the value runtime/autoload/netrw.vim, upstream patch 9.2.0495...

CLSA-2026-1781551234 vim: Fix of CVE-2026-47162

CVE-2026-47162: fix code injection in netrw via a crafted directory name serialized into .netrwhist by NetrwBookHistSave using string to safely encode the value runtime/autoload/netrw.vim, upstream patch 9.2.0495...

CLSA-2026-1781550491 vim: Fix of CVE-2026-47162

CVE-2026-47162: fix code injection in netrw via a crafted directory name serialized into .netrwhist by NetrwBookHistSave using string to safely encode the value runtime/autoload/netrw.vim, upstream patch 9.2.0495...

CLSA-2026-1781535483 Fix CVE(s): CVE-2026-47162

SECURITY UPDATE: code injection in the netrw plugin via directory history serialization: s:NetrwBookHistSave wrote each directory history entry into the generated .netrwhist script by concatenating the raw value inside single quotes, so a directory name containing a single quote and vimscript was...

Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name

...

Vim input validation vulnerability

Vim is an open-source, cross-platform text editor developed by Vim developers. Versions of Vim prior to 9.2.0495 contained a vulnerability due to the netrw plugin. This vulnerability stemmed from the s:NetrwBookHistSave function in the netrw plugin, which inserted directory names derived from the...