Vim’s netrw plugin, which supports file transfer protocols, builds system commands from user‑supplied URLs without proper sanitization. When a user opens a crafted URL such as one using the scp:// scheme, the plugin can inject arbitrary shell commands. The injected commands execute with the privileges of the user running Vim, enabling an attacker to run code on the host with that user’s rights.

Any installation of Vim that uses the bundled netrw plugin and is running a version earlier than 9.2.0073 is affected. The flaw applies to the standard Vim distribution for Linux, macOS, Windows and other platforms where the plugin is enabled, regardless of whether it is compiled with or without network protocol support.

The CVSS score of 4.4 indicates a moderate severity, while the EPSS score of less than one percent suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, limiting the evidence of real‑world attacks. Exploitation requires the victim to open a malicious URL; the most likely attack vector is a local user or an attacker who can trick a user into opening such a link. Because the injected commands run with the same privileges as the Vim process, a local attacker can achieve privilege escalation if the Vim process is started by a privileged account. The official patch is available in Vim 9.2.0073 and later.