PT-2026-39213 · Vim+3 · Vim+3

Megamansec · CVE-2026-42307 · Published 2026-04-29 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0383

Description An OS command injection issue exists in the netrw standard plugin. An attacker can execute arbitrary shell commands with the privileges of the Vim process by inducing a user to open a crafted URL, specifically utilizing the 'sftp://' or 'file://' protocol handlers.

Recommendations Update to version 9.2.0383.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-09838

CVE-2026-42307

ECHO-086C-FDA2-1A2A

GHSA-85CH-P2QR-M5GX

OESA-2026-2447

OESA-2026-2448

OESA-2026-2449

OESA-2026-2450

OESA-2026-2472

OPENSUSE-SU-2026:11114-1

OPENSUSE-SU-2026:20828-1

SUSE-SU-2026:21833-1

SUSE-SU-2026:21840-1

SUSE-SU-2026:21859-1

SUSE-SU-2026:21880-1

SUSE-SU-2026:21944-1

SUSE-SU-2026:2233-1

SUSE-SU-2026:2236-1

SUSE-SU-2026:2313-1

USN-8304-1

Affected Products

Linuxmint

Red Os

Ubuntu

Vim

References · 59

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42307.json · Exploit
• https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc · Patch
• https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gx · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:11114-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45130 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-09838 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42307 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:21833-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45130 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2026-42307 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42307 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2313-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42307 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8304-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2450 · Vendor Advisory