CVE-2026-55895: Vim

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!. This vulnerability is fixed in 9.2.0663.

Affected products

• Vim Vim: before 9.2.0663 (fixed in 9.2.0663)

Published 2026-06-25. Last modified 2026-06-26.