CVE-2026-55895

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0663

Description A Vimscript code injection issue exists in the s:NetrwLocalRmFile() function within the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. The problem occurs because a filename from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the backslash character escaped. An attacker can use a crafted filename containing a bar (|) character to terminate the intended command and execute arbitrary Vimscript, which may include shell commands via :call system() and :!.

Recommendations Update to version 9.2.0663.