The vulnerability is in Vim’s netrw plugin, which builds menu entries by interpolating directory paths into :menu commands when a user browses or bookmarks a directory in GUI Vim. At five construction sites the plugin fails to escape command separators or single quotes, allowing an attacker-controlled path to inject arbitrary Ex and operating‑system commands. Exploitation grants the attacker the ability to run any command with the privileges of the Vim process, resulting in full arbitrary code execution on the local machine.

Vim versions earlier than 9.2.0840 on all platforms that load the netrw plugin are affected. The issue exists for both command‑line and graphic Vim where users can browse or bookmark directories. Upgrading to Vim 9.2.0840 or newer resolves the flaw; older releases must be patched or the netrw plugin disabled to mitigate exposure.

The CVSS score of 8.6 indicates a high severity vulnerability, while the EPSS score of <1% suggests a low current exploitation probability. The flaw is not listed in the CISA KEV catalog. The attack vector requires a local user who can browse or bookmark a malicious directory in GUI Vim; no remote network exploitation is possible. Nevertheless, the impact is significant, as a crafted path can lead to arbitrary command execution with the Vim user’s rights.