{"id":"CVE-2026-47162","title":"Vim is an open source, command line text editor","summary":"Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing br…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-74","CWE-94","CWE-140"],"vendor":"vim","product":"vim","affected":["vim < 9.2.0495"],"patched":["vim 9.2.0495"],"published":"2026-06-11","updated":"2026-09-18","sourceUpdated":"2026-09-18T13:18:28.190","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47162","references":[{"url":"https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b","label":"security-advisories@github.com"},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0495","label":"security-advisories@github.com"},{"url":"https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:38509","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:38510","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:38511","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:53371","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:54769","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:55431","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:58981","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:68711","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-47162","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487964","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47162.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47162"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47162"},{"url":"https://access.redhat.com/errata/RHSA-2026:69128"},{"url":"https://access.redhat.com/errata/RHSA-2026:57614"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.0026,"epssPercentile":0.18011,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-06-12T03:55:42.649076Z"},"scores":{"nvd":8.8,"cna":7.3,"vendor":7.3},"ingestedAt":"2026-09-17T12:16:56.795Z","slug":"CVE-2026-47162","body":"## Overview\n\nVim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.\n\n## Affected\n\n- `vim < 9.2.0495`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `vim 9.2.0495`\n\n## Vendor advisories\n\n- **RHSA-2026:68711** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68711)\n- **RHSA-2026:54769** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:54769)\n- **RHSA-2026:55431** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55431)\n- **RHSA-2026:38509** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38509)\n- **RHSA-2026:38510** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38510)\n- **RHSA-2026:38511** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38511)\n- **RHSA-2026:53371** · Red Hat · fixed in: Red Hat Insights proxy 1.5 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53371)\n- **RHSA-2026:58981** · Red Hat · fixed in: Red Hat Update Infrastructure 5 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:58981)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat Hardened Images · no fix planned: Red Hat Enterprise Linux 6, Red Hat Hardened Images · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47162.json)\n- **RHSA-2026:69128** · Red Hat · fixed in: Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69128)\n- **RHSA-2026:57614** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57614)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":206791,"id":"CVE-2026-47162","ts":1789738941523,"field":"cvss","old":"7.3","new":"8.8"}]}