An OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL, an attacker can execute arbitrary shell commands with the privileges of the Vim process.
| Vendor | Product | Versions |
|---|---|---|
| vim | — | < 9.2.0383 |
