--- id: CVE-2026-47162 title: 'Vim is an open source, command line text editor' summary: >- Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing br… severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H' cwe: - CWE-74 - CWE-94 - CWE-140 vendor: vim product: vim affected: - vim < 9.2.0495 patched: - vim 9.2.0495 published: '2026-06-11' updated: '2026-09-18' sourceUpdated: '2026-09-18T13:18:28.190' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47162' references: - url: 'https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b' label: security-advisories@github.com - url: 'https://github.com/vim/vim/releases/tag/v9.2.0495' label: security-advisories@github.com - url: 'https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c' label: security-advisories@github.com - url: 'https://access.redhat.com/errata/RHSA-2026:38509' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:38510' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:38511' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:53371' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:54769' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:55431' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:58981' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:68711' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-47162' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2487964' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47162.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-47162' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47162' - url: 'https://access.redhat.com/errata/RHSA-2026:69128' - url: 'https://access.redhat.com/errata/RHSA-2026:57614' - url: 'https://access.redhat.com/errata/RHSA-2026:70818' tags: - nvd - cve.org - csaf - vex - red-hat epss: 0.0026 epssPercentile: 0.18044 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-06-12T03:55:42.649076Z' scores: nvd: 8.8 cna: 7.3 vendor: 7.3 ingestedAt: '2026-09-17T12:16:56.795Z' --- ## Overview Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495. ## Affected - `vim < 9.2.0495` ## Remediation Upgrade past the affected range: - `vim 9.2.0495` ## Vendor advisories - **RHSA-2026:68711** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68711) - **RHSA-2026:54769** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:54769) - **RHSA-2026:55431** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55431) - **RHSA-2026:38509** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38509) - **RHSA-2026:38510** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38510) - **RHSA-2026:38511** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38511) - **RHSA-2026:53371** · Red Hat · fixed in: Red Hat Insights proxy 1.5 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53371) - **RHSA-2026:58981** · Red Hat · fixed in: Red Hat Update Infrastructure 5 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:58981) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat Hardened Images · no fix planned: Red Hat Enterprise Linux 6, Red Hat Hardened Images · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47162.json) - **RHSA-2026:69128** · Red Hat · fixed in: Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69128) - **RHSA-2026:57614** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57614) - **RHSA-2026:70818** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6) · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70818)