PT-2026-39213 · Vim+2 · Vim+2

Megamansec · Published 2026-04-29 · Updated 2026-05-25 · CVE-2026-42307

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0383

Description An OS command injection issue exists in the netrw standard plugin. An attacker can execute arbitrary shell commands with the privileges of the Vim process by inducing a user to open a crafted URL, specifically utilizing the 'sftp://' or 'file://' protocol handlers.

Recommendations Update to version 9.2.0383.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-42307

ECHO-086C-FDA2-1A2A

OESA-2026-2447

OESA-2026-2448

OESA-2026-2449

OESA-2026-2450

USN-8304-1

Affected Products

Linuxmint

Ubuntu

Vim

References · 32

• https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc · Patch
• https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gx · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45130 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42307 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2026-42307 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2450 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42307 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42307 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-42307 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42307 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44656 · Security Note
• https://ubuntu.com/security/CVE-2026-44656 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8304-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2449 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8304-1 · Vendor Advisory