CVE-2026-47162 @ Library

"CVE-2026-47162"
"vim-8.0.0197-4+deb9u7"
"vim-common-8.0.0197-4+deb9u7"
"vim-runtime-8.0.0197-4+deb9u7"
"vim-tiny-8.0.0197-4+deb9u7"
"Am I vulnerable?"

Status

accepted_risk

Priority

5.14

Match score

4.0

Risk

RCE Remote priv:user

CVSS

8.8 HIGH

Reason

cpe: vim; pkgs: vim; version: in-range: vim-8.0.0197-4+deb9u7, vim-common-8.0.0197-4+deb9u7, vim-runtime-8.0.0197-4+deb9u7, vim-tiny-8.0.0197-4+deb9u7; risk:rce; remote

Created

2026-08-11T10:15:48Z

Updated

2026-08-22T10:15:42Z

Closed

2026-08-11T15:18:25Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

Package	Commands
vim-8.0.0197-4+deb9u7
vim-common-8.0.0197-4+deb9u7
vim-runtime-8.0.0197-4+deb9u7
vim-tiny-8.0.0197-4+deb9u7

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: vim · vim-common · vim-runtime · vim-tiny

System	Matches	Ticket for CVE-2026-47162
Archive	vim-runtime 2:8.1.0875-5+deb10u6	accepted_risk open
Janus	vim-runtime 2:8.1.0875-5+deb10u6	accepted_risk open
Library	vim-runtime 2:8.0.0197-4+deb9u7	accepted_risk open
Matrix	vim-runtime 2:9.0.1378-2+deb12u2	accepted_risk open
Saiph	vim-runtime 2:8.1.0875-5+deb10u6	accepted_risk open

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

Debian GNU/Linux 9 (stretch) (9) · debian

Arch

x86_64

kernel_release

uname -r → 4.9.0-19-amd64

kernel_version

uname -v → #1 SMP Debian 4.9.320-2 (2022-06-30)

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System	Status	Priority	Updated
Matrix	accepted_risk	5.14	2026-08-22T10:15:42Z	Open
Archive	accepted_risk	3.82	2026-08-22T10:15:42Z	Open
Janus	accepted_risk	3.82	2026-08-22T10:15:42Z	Open
Saiph	accepted_risk	3.82	2026-08-22T10:15:42Z	Open

Description

Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.

Determination

Practical risk

Requires the user to browse a maliciously named directory with netrw (Vim’s built-in file browser).
The malicious directory name is written into ~/.vim/.netrwhist.
The next time that history file is sourced, arbitrary Vimscript (including shell commands) can run.
No local users
No public access

Update status

Add note only

Mitigation log

2026-08-11T15:17:16Z — affects

Practical risk Requires the user to browse a maliciously named directory with netrw (Vim’s built-in file browser). The malicious directory name is written into ~/.vim/.netrwhist. The next time that history file is sourced, arbitrary Vimscript (including shell commands) can run.

2026-08-11T15:18:25Z — accepted_risk

No local users No public access

References

NVD: CVE-2026-47162