CVE-2026-55895

HighCVSS 7.8/10Last modified Jun 26, 2026

Description

Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!. This vulnerability is fixed in 9.2.0663.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jun 25, 2026
Last modified: Jun 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-558978.8luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative fi CVE-2026-558987.1Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2026-558997.8Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-55905.3A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released. If tcp_conn_CVE-2026-55946.3A weakness has been identified in premAI-io premsql up to 0.2.1. Affected is the function eval of the file premsql/agents/baseline/workers/f CVE-2026-559449.8Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network.CVE-2026-559454.2Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an aut CVE-2026-559465.9Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.CVE-2026-559477.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-559487.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-559497.8Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-55956.3A security vulnerability has been detected in griptape-ai griptape 0.19.4. Affected by this vulnerability is the function load_files_from_di