Description
Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.
Problem types
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Product status
References
github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gx
github.com/...ommit/405e2fb6d54d5653523809e2853d99d1c000a5fc
github.com/vim/vim/releases/tag/v9.2.0383