Code Injection in Vim - CVE-2026-55895

Detailed vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper control of code generation in s:NetrwLocalRmFile() in the netrw plugin when deleting a local file from the browser using a crafted filename from the directory listing. A remote attacker can place a file with a crafted name containing Ex command separators and trick the victim into deleting that entry to execute arbitrary code.

User interaction is required to delete the specific crafted file entry, and exploitation is limited to environments where filenames may contain the bar character.

How to mitigate CVE-2026-55895

Sources

• https://github.com/vim/vim/security/advisories/GHSA-vhh8-v6wx-hjjh
• https://github.com/vim/vim/commit/55bc757a5d436e59d50fe43f7cda94b118f86cb2