CVE-2026-28417: Vim

High severity, CVSS 7.8. EPSS: 1.4% chance of exploitation in the next 30 days.

Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.

Affected products

• Vim Vim: before 9.2.0073 (fixed in 9.2.0073)

Published 2026-02-27. Last modified 2026-06-17.