CVE-2026-42307 Vim: OS Command Injection in netrw

Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL e.g., using the sftp:// or file:// protocol handlers, an attacker can execute arbitrary...

CVE-2026-42307 Vim: OS Command Injection in netrw

Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL e.g., using the sftp:// or file:// protocol handlers, an attacker can execute arbitrary...

CVE-2026-42307 Vim: OS Command Injection in netrw

Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL e.g., using the sftp:// or file:// protocol handlers, an attacker can execute arbitrary...

CVE-2026-42307

Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL e.g., using the sftp:// or file:// protocol handlers, an attacker can execute arbitrary...

VIM Plugin Persistence

This module creates a VIM Plugin which executes a payload on VIM startup. Module Options msf use exploit/linux/persistence/vimplugin msf exploitvimplugin show targets ...targets... msf exploitvimplugin set TARGET msf exploitvimplugin show options ...show and set options... msf exploitvimplugin...

CLSA-2026-1778259521 vim: Fix of 4 CVEs

CVE-2022-3278: fix crash when using NUL in buffer that uses :source; don't get a next line when skipping over NL in evalnextnonblank eval.c, upstream patch 9.0.0552 - CVE-2023-48234: fix overflow when getting count for normal z command; break out of nvzet count loop when n LONGMAX/10 normal.c,...

Security update for vim

This update for vim fixes the following issue: Security fixes: CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes bsc1261833. Other fixes: Update to 9.2.0398. 9.2.0398: MS-Windows: missing strptime support 9.2.0397: tabpanel: double-click opens a n...

SUSE-SU-2026:1764-1 Security update for vim

This update for vim fixes the following issue: Security fixes: - CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes bsc1261833. Other fixes: - Update to 9.2.0398. 9.2.0398: MS-Windows: missing strptime support 9.2.0397: tabpanel: double-click opens...

VIM Plugin Persistence

This Metasploit module creates a VIM Plugin which executes a payload on VIM startup...

Vim 安全漏洞

Vim is an open-source, cross-platform text editor developed by Vim developers. Versions of Vim prior to 9.2.0450 contained security vulnerabilities. These vulnerabilities were caused by a heap buffer overflow in the readcompound function, which could allow attackers to exploit a specially crafted...

Vim 操作系统命令注入漏洞

Vim is an open-source, cross-platform text editor developed by Vim developers. Versions of Vim prior to 9.2.0435 contained a vulnerability related to operating system command injection. This vulnerability originated from the OS command injection during the completion of the find command, which...

Vim 操作系统命令注入漏洞

Vim is an open-source, cross-platform text editor developed by Vim developers. Versions of Vim prior to 9.2.0383 contained a vulnerability related to operating system command injection. This vulnerability stemmed from the netrw standard plugin, which allowed for OS command injection. This could...

PT-2026-39222

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0450 Description A heap buffer overflow occurs in the read compound function within src/spellfile.c when loading a specially crafted spell file .spl while UTF-8 encoding is active. An attacker-controlled length field ...

CLSA-2026-1778021665 vim: Fix of CVE-2026-39881

CVE-2026-39881: fix netbeans defineAnnoType command injection by validating typeName, fg and bg against an allowlist before passing them to coloncmd; also restrict specialKeys tokens to alphanumeric characters to prevent map command injection...

USN-8246-1 vim vulnerabilities

Michał Majchrowicz discovered that Vim’s zip plugin could overwrite arbitrary files. An attacker could possibly use this issue to delete sensitive data or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. CVE-2026-35177 It was discovered that Vim’s netbeans interface did not...

USN-8246-1: Vim vulnerabilities

Michał Majchrowicz discovered that Vim’s zip plugin could overwrite arbitrary files. An attacker could possibly use this issue to delete sensitive data or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. CVE-2026-35177 It was discovered that Vim’s netbeans interface did not...

CLSA-2026-1778140717 vim: Fix of 10 CVEs

CVE-2022-0158: fix Vim9 reading before start of line with single $ - CVE-2022-0696: fix crash when switching tabpage in cmdline window - CVE-2022-1674: fix crash when matching buffer with invalid pattern - CVE-2022-1725: fix using NULL regexp program in buffer matching - CVE-2022-1771: fix...

CLSA-2026-1778133583 vim: Fix of 10 CVEs

CVE-2022-0158: fix Vim9 reading before start of line with single $ - CVE-2022-0696: fix crash when switching tabpage in cmdline window - CVE-2022-1674: fix crash when matching buffer with invalid pattern - CVE-2022-1725: fix using NULL regexp program in buffer matching - CVE-2022-1771: fix...

[SECURITY] Fedora 42 Update: vim-9.2.390-1.fc42

VIM VIsual editor iMproved is an updated and improved version of the vi editor. Vi was the first real screen-based editor for UNIX, and is still very popular. VIM improves on vi by adding new features: multiple windows, multi-level undo, block highlighting and more...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2026-016511)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016511 advisory. Vim is an open source, command line text editor. A use-after-free was found in Vim 9.1.0764. When closing a buffer visible in a window a BufWinLeave auto command can...