VDB
ALPINE-CVE-2026-28417
ALPINE-CVE-2026-28417
PUBLISHED
CVSS 7.800000190734863 HIGH
Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.
Risk Scores
CVSS v3.1
7.800000190734863
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.23 | vim | 7.2.284-r0, 7.2.394-r0, 7.2.411-r0 |
Timeline
- Feb 27, 2026 CVE Published
- Mar 4, 2026 CVE Updated
- Apr 30, 2026 Distribution Patch