CVE-2026-73078: 
Vim Analyse et atténuation des vulnérabilités

CVE-2026-73078 is a command injection vulnerability in Vim's netrw file browser plugin that allows arbitrary Ex and operating-system command execution via crafted directory paths in GUI Vim. It affects all Vim versions prior to 9.2.0840 and was disclosed on July 23, 2026, by researcher David Carliez. The vulnerability carries a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, Feedly).

The root cause is an incomplete list of disallowed inputs (CWE-184) combined with command injection (CWE-77) in runtime/pack/dist/opt/netrw/autoload/netrw.vim. The g:netrw_menu_escape variable, used to sanitize directory paths before interpolating them into :menu commands, did not include the Ex command separator |. Because :menu carries the EX_TRLBAR attribute, an unescaped | in a path terminates the :menu command and causes the remainder to be parsed as additional Ex commands — including :! for OS-level execution. Five construction sites are affected: s:NetrwBookmarkMenu() (bookmark goto and delete entries, history entry) and s:NetrwTgtMenu() (bookmark and history Targets menu entries); two of these also embed paths in single-quoted Vim strings via netrw#MakeTgt() without neutralizing single quotes, enabling Vim script injection. The fix adds | to g:netrw_menu_escape, uses fnameescape() for right-hand-side paths, and replaces raw single-quote interpolation with string() (GitHub Advisory, Fix Commit).

Successful exploitation allows arbitrary Ex command execution and, via :!, arbitrary operating-system command execution in the context of the user running Vim. An attacker who can control a directory path that a victim browses or bookmarks in GUI Vim — for example via a shared filesystem, FTP, or SFTP share — can achieve full code execution with the victim's privileges. Confidentiality, integrity, and availability are all rated High impact under CVSS v4.0. Notably, terminal (non-GUI) Vim is not affected; exploitation is limited to GUI Vim instances with the menu bar enabled (GitHub Advisory, Feedly).

As of the time of disclosure, no public proof-of-concept exploit exists and no in-the-wild exploitation has been observed (Feedly). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable — it requires user interaction (the victim must browse or bookmark a crafted path in GUI Vim with menus enabled), limiting its practical attack surface (GitHub Advisory).

1. Prepare a crafted directory path: Create a directory whose name contains the Ex command separator | followed by arbitrary Ex or shell commands (e.g., malicious|!calc.exe on Windows or malicious|!bash -c 'id>/tmp/pwned' on Linux).
2. Host the path accessibly: Place the crafted directory on a shared filesystem (SMB/NFS), FTP server, or SFTP server accessible to the target user.
3. Induce the victim to browse the path: Social-engineer or otherwise cause the victim to open GUI Vim and navigate to the crafted directory using netrw (e.g., by sharing a link or file path that opens in netrw).
4. Trigger menu construction: When the victim browses the crafted path, netrw records it in its history and calls s:NetrwBookmarkMenu() or s:NetrwTgtMenu(), interpolating the unsanitized path into a :menu command.
5. Achieve code execution: The unescaped | terminates the :menu command; the injected Ex commands (including :! for OS commands) execute with the privileges of the Vim process (GitHub Advisory, Fix Commit).

• File System: Unexpected files created by the Vim process (e.g., output files from injected :! commands such as /tmp/pwned or similar); new scripts or executables dropped in user-writable directories.
• Process: Unusual child processes spawned by the GUI Vim process (e.g., bash, sh, cmd.exe, powershell, curl, wget) — particularly those not initiated by the user directly.
• Logs: System audit logs (e.g., auditd on Linux) showing process execution events with Vim as the parent process for unexpected commands; shell history entries reflecting commands that were injected rather than typed.
• Network: Outbound connections from the Vim process to unexpected remote hosts, particularly if the injected payload includes a reverse shell or data exfiltration command.

Upgrade Vim to version 9.2.0840 or later, which adds | to g:netrw_menu_escape, applies fnameescape() to right-hand-side paths, and uses string() for netrw#MakeTgt() arguments (Fix Commit). As a temporary workaround until patching is possible, avoid browsing or bookmarking untrusted directory paths in GUI Vim, or disable the netrw menu by setting let g:netrw_menu = 0 in your .vimrc. Terminal (non-GUI) Vim users are not affected and require no action (GitHub Advisory).

The Vim project rated the severity as "Moderate" in its GitHub Security Advisory, noting that the console version of Vim is unaffected and that exploitation requires the victim to browse a crafted path in GUI Vim. The fix was authored by Yasuhiro Matsumoto and committed by Christian Brabandt, with the vulnerability reported by David Carliez (GitHub Advisory). No significant broader media coverage or notable community controversy has been observed at this time.