High 8.8Published Jun 11, 2026

CVE-2026-47162Vim is an open source, command line text editor.

Updated under an hour ago (2026-10-19 11:10 UTC)

Does this affect you?

It affects vim. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for vim

Exploited in the last 30 days

Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.

CVSS: 8.8 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-74, CWE-94, CWE-140
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Sep 18, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

vim vim vim:vim	before 9.2.0495	NVD

References

https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694bpatch
https://github.com/vim/vim/releases/tag/v9.2.0495product
https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7cvendor-advisory
https://access.redhat.com/errata/RHSA-2026:38509
https://access.redhat.com/errata/RHSA-2026:38510
https://access.redhat.com/errata/RHSA-2026:38511
https://access.redhat.com/errata/RHSA-2026:53371
https://access.redhat.com/errata/RHSA-2026:54769
https://access.redhat.com/errata/RHSA-2026:55431
https://access.redhat.com/errata/RHSA-2026:58981
https://access.redhat.com/errata/RHSA-2026:68711
https://access.redhat.com/security/cve/CVE-2026-47162
https://bugzilla.redhat.com/show_bug.cgi?id=2487964
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47162.json

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.