CVE-2026-47162: Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name

Synopsis

Vimscript code injection in Vim's netrw plugin allows an attacker to embed arbitrary Vimscript in a crafted directory name, which gets written unescaped to the ~/.vim/.netrwhist history file and executed the next time Vim sources that file. Reaching this vulnerability requires network access (netrw browses remote paths), a low-privilege account, and a victim opening Vim after visiting a malicious directory. Successful exploitation gives the attacker full code execution in the Vim process context, including shell command access via system() and :!. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must serve a crafted directory name over the network to a victim browsing remote paths via netrw, requiring the victim's Vim instance to reach an attacker-controlled network location.

• AuthenticationRequired

  The CVSS vector specifies PR:L, meaning the attacker needs at least a low-privilege account or equivalent access to stage or serve the malicious directory structure.

• Victim interactionRequired

  The CVSS vector specifies UI:A, meaning the victim must actively browse the attacker-controlled directory with netrw and then reopen Vim so that the poisoned history file is sourced.

• Attack complexityDetail

  The CVSS vector specifies AC:L but AT:P, meaning the exploit logic itself is straightforward and reliable, but specific target conditions (such as the victim having netrw history enabled and sourcing the history file) must be in place.

Blast Radius

• Reads files accessible to the Vim process owner, including SSH keys, shell history, and local credentials stored in dot-files.
• Modifies files writable by the Vim process owner, including shell configuration files that could establish persistence.
• Executes arbitrary shell commands in the context of the logged-in user via Vimscript system() or :! at the moment the history file is sourced.