Every CVESearch/Get API key

CVE-2008-6235

The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute...

9.3 HighFix available

CVE-2008-6235 is a high vulnerability (CVSS 9.3) in Vim, published February 21, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.99%, the 87th percentile. Fixed in vim 2:7.2.148-1.

What does this mean?
Severity
9.3 HighCVSS 2.0, NVD
Exploit chance
2.99%EPSS, 87th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2:7.2.148-1vim +14 more

Description

The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases.

Exploit likelihood

2.99%Up 1.5 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
vim
Debian:12
before 2:7.2.148-1
2:7.2.148-1
vim
Debian:13
before 2:7.2.148-1
2:7.2.148-1
vim
Debian:14
before 2:7.2.148-1
2:7.2.148-1
vim
Red Hat:enterprise_linux:5::client
From an advisory covering 6 CVEs
before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-X11
Red Hat:enterprise_linux:5::client
From an advisory covering 6 CVEs
before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-common
Red Hat:enterprise_linux:5::client
From an advisory covering 6 CVEs
before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 6 CVEs
before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-enhanced
Red Hat:enterprise_linux:5::client
From an advisory covering 6 CVEs
before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-minimal
Red Hat:enterprise_linux:5::client
From an advisory covering 6 CVEs
before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
Show 5 moreShow less
Affected packages
PackageAffectedFixed
vim-X11
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-common
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-enhanced
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-minimal
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z

What each source reports

NVD Score used9.3

The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases.

Record
CVE-2008-6235
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-78
Updated
2026-11-02
CVE ListNo score

The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases.

Record
CVE-2008-6235
Updated
2026-11-02
EUVDEUVD-2008-6205No score

The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases.

Record
EUVD-2008-6205
Updated
2026-11-03
GitHub AdvisoriesGHSA-f7gm-2q6r-xxwvNo score

The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute...

The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases.

Record
GHSA-f7gm-2q6r-xxwv
Weakness
CWE-78
Updated
2026-11-02
OSVNo score

The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases.

Record
CVE-2008-6235
Updated
2026-11-02
OSVDEBIAN-CVE-2008-6235No score

The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases.

Record
DEBIAN-CVE-2008-6235
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 32 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open