CVE-2026-28417 - Vim has OS Command Injection in netrw

CVE ID : CVE-2026-28417 Published : Feb. 27, 2026, 10:16 p.m. | 1 hour, 22 minutes ago Description : Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue. Severity: 4.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...