Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-ar9v-jmw8-e7aq
Vulnerability ID VCID-ar9v-jmw8-e7aq
Aliases CVE-2026-42307
Summary Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.
Status Published
Exploitability 0.5
Weighted Severity 6.6
Risk 3.3
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
System Score Found at
cvssv3 7.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-42307.json
epss 0.00224 https://api.first.org/data/v1/epss?cve=CVE-2026-42307
epss 0.00224 https://api.first.org/data/v1/epss?cve=CVE-2026-42307
cvssv3.1 4.4 https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc
ssvc Track https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc
cvssv3.1 4.4 https://github.com/vim/vim/releases/tag/v9.2.0383
ssvc Track https://github.com/vim/vim/releases/tag/v9.2.0383
cvssv3.1 4.4 https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gx
ssvc Track https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gx
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-42307.json
https://api.first.org/data/v1/epss?cve=CVE-2026-42307
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42307
2468403 https://bugzilla.redhat.com/show_bug.cgi?id=2468403
405e2fb6d54d5653523809e2853d99d1c000a5fc https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc
GHSA-85ch-p2qr-m5gx https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gx
USN-8304-1 https://usn.ubuntu.com/8304-1/
v9.2.0383 https://github.com/vim/vim/releases/tag/v9.2.0383
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-42307.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T17:24:20Z/ Found at https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/vim/vim/releases/tag/v9.2.0383
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T17:24:20Z/ Found at https://github.com/vim/vim/releases/tag/v9.2.0383
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gx
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T17:24:20Z/ Found at https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gx
Exploit Prediction Scoring System (EPSS)
Percentile 0.45189
EPSS Score 0.00224
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:44:16.122138+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/42xxx/CVE-2026-42307.json 38.6.0