CVE-2026-28417
Vim is an open source, command line text editor.
Published Feb 27, 2026 · updated Jun 17, 2026 · vim vim
Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Feb 27, 2026 · NIST NVD
Detected
Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.
Jun 17, 2026 · NIST NVD
Updated
Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.
Affected
- cpe vim/vimversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-28417
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-28417
Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the protocol handler), an attacker can execute
nvd.nist.gov