CVE-2026-55895

A flaw was found in Vim, specifically within the netrw plugin. A local user could exploit a Vimscript code injection vulnerability by attempting to delete a specially crafted local file from the browser. This crafted filename, containing a bar character, could be interpolated into an Ex command, allowing for the execution of arbitrary Vimscript, including shell commands. This could lead to arbitrary code execution on the affected system.

This is an Important vulnerability in Vim's netrw plugin that could lead to arbitrary code execution. A local attacker could exploit this flaw by enticing a user to delete a specially crafted file within the netrw file browser, allowing for the injection and execution of arbitrary Vimscript commands, including shell commands. This risk is mitigated by the requirement for local user interaction and a specific sequence of actions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.