Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!. This vulnerability is fixed in 9.2.0663.

An update of the vim package has been released.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0573 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-55895:
    Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection     vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin     (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename     derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute     with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate     the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!.
    This vulnerability is fixed in 9.2.0663.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8500-1 advisory.

    It was discovered that Vim incorrectly handled path traversal in the zip.vim plugin. An attacker could     possibly use this issue to overwrite arbitrary files. This issue only affected Ubuntu 14.04 LTS, Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-35177)

    It was discovered that Vim incorrectly handled depth tracking when processing spell files. An attacker     could possibly use this issue to cause a denial of service. (CVE-2026-55693, CVE-2026-55892)

    It was discovered that Vim incorrectly handled filename escaping in the netrw plugin. An attacker could     possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04     LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.
    (CVE-2026-55895)

    It was discovered that Vim incorrectly handled length calculations when opening encrypted files. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04     LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-57452)

    Dhruv Vishesh Gupta discovered that Vim incorrectly handled quoting of archive entry names. An attacker     could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 26.04 LTS.
    (CVE-2026-57453)

    It was discovered that Vim incorrectly handled bounds checking when translating words through a byte map.
    An attacker could possibly use this issue to cause a denial of service. (CVE-2026-57455)

    Chenyuan Mi discovered that Vim incorrectly handled docstring escaping during Python omni-completion. An     attacker could possibly use this issue to execute arbitrary code. (CVE-2026-57456)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Vim installed on the remote host is prior to 9.2.0663. It is, therefore, affected by a vulnerability.

  - A Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin     (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename derived     from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the     backslash character escaped, allowing a crafted filename containing a bar (|) to terminate the intended command and     execute arbitrary Vimscript, including shell commands via :call system() and :!. (CVE-2026-55895)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection     vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin     (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename     derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute     with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate     the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!.
    This vulnerability is fixed in 9.2.0663. (CVE-2026-55895)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in
    src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes
    that apply to a word. The counter is bounded only by the trie structure itself; it is never checked
    against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A
    crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so
    the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the
    call frame and crashes the editor. This vulnerability is fixed in 9.2.0662. (CVE-2026-55892)

  - Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection
    vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin
    (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename
    derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute
    with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate
    the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!.
    This vulnerability is fixed in 9.2.0663. (CVE-2026-55895)

ID	Name	Product	Family	Severity
325971	Photon OS 4.0: Vim PHSA-2026-4.0-1049	Nessus	PhotonOS Local Security Checks	high
325846	TencentOS Server 4: vim (TSSA-2026:0573)	Nessus	Tencent Local Security Checks	high
324991	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Vim vulnerabilities (USN-8500-1)	Nessus	Ubuntu Local Security Checks	high
324733	Vim < 9.2.0663 Code Injection (GHSA-vhh8-v6wx-hjjh)	Nessus	Misc.	high
323929	Photon OS 5.0: Vim PHSA-2026-5.0-0908	Nessus	PhotonOS Local Security Checks	high
323738	Linux Distros Unpatched Vulnerability : CVE-2026-55895	Nessus	Misc.	high
443613	Alpine: gvim, multiple vim packages, xxd: security update to 9.2.0663-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
443613	Alpine: gvim, multiple vim packages, xxd: security update to 9.2.0663-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high

Detections

Analytics

CVE-2026-55895

high

Tenable Plugins

high

high

high

high

high

high

high

high