Vim’s built‑in netrw plugin contains an OS command injection flaw. When a user opens a specially crafted URL (such as those using sftp:// or file://), Vim executes arbitrary shell commands with the privileges of the Vim process. This enables an attacker to compromise confidentiality, integrity, and availability by running commands, installing malware, or modifying system files, and is classified as CWE‑78.

All releases of Vim before 9.2.0383 are affected. The issue is fixed in version 9.2.0383 and later.

The vulnerability has a CVSS score of 4.4, indicating a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to get a user to open a malicious URL, so it typically relies on social engineering. Because the fix is already available, the practical risk depends on whether systems are running a patched version.