Vim netrw Plugin OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in the netrw standard plugin of Vim, affecting versions prior to 9.2.0383. The issue arises when netrw processes URLs using the sftp or file protocols. Attackers can exploit this vulnerability by crafting a URL that, when opened by the user, executes arbitrary shell commands with the privileges of the Vim process. This exploitation is possible because the temporary file names used by netrw can be manipulated to include shell metacharacters, which are then executed as commands.

Impact

Exploitation of this vulnerability allows for arbitrary shell command execution within the context of the Vim process.

Reproduction

The vulnerability can be reproduced by opening a file URL or an SFTP URL that has been crafted to include shell metacharacters in the filename. This can be done by appending commands to the URL in a way that exploits the temporary file naming process of the netrw plugin.

Remediation

Users can upgrade to Vim version 9.2.0383 or later to address this vulnerability.