CVE-2026-47162— Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name
Possible ATT&CK Techniques 3AI
T1610 · Deploy Container T1059 · Command and Scripting Interpreter T1203 · Exploitation for Client ExecutionGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-47162
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name
Source: CVE Program / CVE List V5
Vulnerability Description
Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Vim 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Vim是Vim开源的一款跨平台的文本编辑器。 Vim 9.2.0495之前版本存在注入漏洞，该漏洞源于netrw插件中的s:NetrwBookHistSave函数在序列化浏览目录路径到历史文件时，将文件系统派生的目录名插入到单引号Vimscript字符串字面量中而未转义单引号，可能导致特制目录名突破字符串上下文并执行任意Vimscript。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-47162
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47162
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-47162 (1)
Vendor Advisories for CVE-2026-47162 (1)
Vendor Pages for CVE-2026-47162 (1)
- 🔗 Release v9.2.0495 · vim/vim · GitHubx_refsource_MISC
Same Patch Batch · vim · 2026-06-11 · 5 CVEs total
| CVE-2026-52860 | Vim: Arbitrary Code Execution via Python Omni-Completion | |
| CVE-2026-52859 | Vim: Out-of-bounds Read in Terminal Screen Snapshot | |
| CVE-2026-52858 | Vim: Arbitrary Code Execution via Python Omni-Completion | |
| CVE-2026-47167 | Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition rege |
IV. Related Vulnerabilities
Same product: vim
- CVE-2026-59856
Vim: Arbitrary Code Execution via PHP Omni-Completion - CVE-2026-59858
Vim: Arbitrary Code Execution via C Omni-Completion - CVE-2026-59857
Vim: Out-of-bounds Write in SAL Soundfolding - CVE-2026-55693
Vim: Out-of-bounds Write in Spell File Word Count - CVE-2026-55892
Vim: Out-of-bounds Write in Spell File Prefix Dump
Same vendor: vim
- CVE-2026-59856
Vim: Arbitrary Code Execution via PHP Omni-Completion - CVE-2026-59858
Vim: Arbitrary Code Execution via C Omni-Completion - CVE-2026-59857
Vim: Out-of-bounds Write in SAL Soundfolding - CVE-2026-55693
Vim: Out-of-bounds Write in Spell File Word Count - CVE-2026-55892
Vim: Out-of-bounds Write in Spell File Prefix Dump
Same weakness: CWE-74
- CVE-2026-48120
Kakoune has a Critical RCE via Autorestore Backup Filename I - CVE-2026-68747
CSS sanitizer allowlist bypass in html_sanitize_ex via non-d - CVE-2026-71320
Nuxt: Server-Side Remote Code Execution via Runtime Template - CVE-2026-20272
Cisco IOS XE Software Security Hardening Release - CVE-2026-18613
GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_c
V. Comments for CVE-2026-47162
No comments yet