Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Vim netrw plugin can run commands via crafted folder name
published 4 months ago
Summary
If you use Vim versions older than 9.2.0495, a specially named folder can cause Vim to execute unwanted commands when it reads its directory history file. This happens because the folder name isn't properly escaped, letting attackers inject code that can run shell commands. Upgrade Vim to version 9.2.0495 or later to fix the issue.
What to do
- Update echo vim to version 2:9.2.0524-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Echo | echo | vim |
< 2:9.2.0524-1 Fix: upgrade to 2:9.2.0524-1
|
Original advisory text
ECHO-1d9f-02a2-cd6e
References
Timeline
Published12 Jun 2026
Updated13 Jun 2026
First seen13 Jun 2026
Sources
ECHO-1d9f-02a2-cd6e · OSV
Track software like this
Free during beta