CVE-2026-73078 in Vim
Summary
by MITRE • 08/11/2026
Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability exists within the netrw plugin of vim text editor, specifically affecting versions prior to 9.2.0840. This flaw resides in the runtime/plugin/netrwPlugin.vim file and related autoload scripts that handle directory navigation and menu construction. The issue stems from improper input validation when processing user-supplied directory paths during bookmark creation, history management, and target menu generation. Attackers can exploit this vulnerability by crafting malicious directory paths that contain command injection sequences, particularly targeting the | character separator and single quote delimiters that are not properly neutralized during menu entry construction.
The technical implementation of this vulnerability involves multiple attack vectors through the netrw plugin's menu construction functions. Specifically, the s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), and related functions fail to sanitize user input before incorporating it into Ex commands. The g:netrw_menu_escape variable and EX_TRLBAR constants do not adequately protect against command injection attempts, while netrw#MakeTgt() function lacks proper escaping mechanisms for special characters. When a user browses or bookmarks directories containing maliciously crafted paths, the system interpolates these unescaped inputs directly into :menu commands, creating opportunities for arbitrary command execution.
This vulnerability presents significant operational impact in GUI environments where users interact with file browsers and navigation menus. The attack surface expands when users navigate through network shares, remote filesystems, or directories containing specially crafted pathnames that include shell command sequences. An attacker could potentially execute arbitrary Ex commands within vim's context or trigger operating system command execution, depending on the environment and privileges available to the running vim process. The vulnerability affects both local file browsing scenarios and remote filesystem access through vim's network capabilities.
Mitigation strategies should focus on immediate patch application to version 9.2.0840 or later, which properly addresses the input sanitization issues in the netrw plugin. Organizations should also implement network segmentation and access controls to limit exposure of systems running vulnerable versions of vim. Security teams should consider disabling unnecessary vim plugins in production environments where command injection risks are elevated. Additionally, user training on avoiding suspicious directory names and implementing proper input validation at multiple layers provides defense-in-depth protection against exploitation attempts. The vulnerability aligns with CWE-78 (Improper Neutralization of Special Elements used in OS Command) and represents a command injection weakness that can be classified under ATT&CK technique T1059.006 (Command and Scripting Interpreter: Python).