CVE-2026-73078: Vim: Arbitrary Code Execution via Netrw Menu Construction
Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrwmenuescape, EXTRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.
Other sources
Vim: Arbitrary Code Execution via Netrw Menu Construction
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.0957-1 - Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.1.1230-2+deb13u1 - Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.2.0858-1 - Upgrade
Upgrade
alpine/vimto a version that resolves this vulnerability.Fixed in 9.2.0854-r0 - Upgrade
Upgrade
alpine/vimto a version that resolves this vulnerability.Fixed in 9.2.0843-r0 - Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.1.1230-2+deb13u2Fixed in 2:9.2.0858-1 - Upgrade
Upgrade
Vimto a version that resolves this vulnerability.Fixed in 9.2.0840
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73078?
CVE-2026-73078 has a risk score of 77, indicating it is a high severity vulnerability.
How do I fix CVE-2026-73078?
To mitigate CVE-2026-73078, update Vim to version 9.2.0840 or later as it contains the necessary security fixes.
What can exploit CVE-2026-73078?
CVE-2026-73078 can be exploited through user-controlled directory paths inserted into the Netrw menu commands.
What type of vulnerability is CVE-2026-73078?
CVE-2026-73078 is classified as a command injection vulnerability.
In which software is CVE-2026-73078 found?
CVE-2026-73078 is found in the Vim text editor versions prior to 9.2.0840.