CVE-2026-73078: Vim Text Editor RCE Vulnerability

CVE-2026-73078 Overview

CVE-2026-73078 is a command injection vulnerability [CWE-77] in Vim's netrw plugin affecting versions prior to 9.2.0840. The flaw resides in runtime/plugin/netrwPlugin.vim and runtime/pack/dist/opt/netrw/autoload/netrw.vim, where Bookmarks, History, and Targets menu entries are constructed by interpolating attacker-controlled directory paths into executed :menu commands. Five construction sites, including s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt(), fail to neutralize the | command separator or single quotes. A crafted path browsed or bookmarked in GUI Vim triggers arbitrary Ex and operating-system command execution.

Critical Impact
A user browsing or bookmarking a crafted directory path in GUI Vim executes attacker-controlled Ex and OS commands with the user's privileges.

Affected Products

Vim (GUI) versions prior to 9.2.0840
netrw runtime plugin bundled with Vim
Distributions shipping Vim with netrw enabled by default

Discovery Timeline

2026-08-11 - CVE-2026-73078 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73078

Vulnerability Analysis

The netrw plugin builds GUI menu entries dynamically from filesystem paths visited by the user. When constructing the Bookmarks, History, and Targets menus, netrw interpolates directory strings into :menu command invocations without properly escaping Ex command metacharacters. The g:netrw_menu_escape variable and the EX_TRLBAR handling do not strip or quote the | (pipe) character, which Vim interprets as an Ex command separator. Single quotes are also left unescaped, breaking out of the intended string context. As a result, a path such as /tmp/foo'|!id|echo' becomes part of an executable Ex command chain rather than a passive menu label.

Root Cause

The root cause is improper neutralization of special elements used in a command [CWE-77]. Five distinct construction sites, s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt(), treat attacker-controlled directory names as trusted string data. Vim's :menu command parser evaluates embedded | separators, allowing chained Ex commands including :! shell execution.

Attack Vector

An attacker crafts a directory whose name contains Ex command metacharacters. The victim opens or bookmarks that directory in GUI Vim with netrw enabled. Menu construction executes the injected commands under the victim's user context. Delivery vectors include shared filesystems, archives that extract with malicious directory names, network shares, and repositories that contain attacker-named folders.

text

# Upstream patch metadata from src/version.c
static int included_patches[] =
{   /* Add new patch number below this line */
/**/
    840,
/**/
    839,
/**/

# runtime/pack/dist/opt/netrw/autoload/netrw.vim header change
- " Last Change: 2026 Jul 22
+ " Last Change: 2026 Jul 23

Source: Vim commit 29c6fd0

Detection Methods for CVE-2026-73078

Indicators of Compromise

Unexpected child processes spawned by gvim, vim, or mvim, particularly shells such as /bin/sh, bash, or cmd.exe.
Filesystem artifacts containing directory names with embedded |, !, or single-quote characters.
Modifications to ~/.netrwbook or ~/.netrwhist referencing paths with Ex metacharacters.

Detection Strategies

Hunt for process trees where a Vim binary launches interpreters or networking utilities such as curl, wget, or nc.
Scan user home directories and shared mounts for directory names containing |, backticks, or unbalanced single quotes.
Inventory installed Vim versions across endpoints and flag any build older than 9.2.0840.

Monitoring Recommendations

Enable command-line auditing on Linux via auditd execve rules and on Windows via Sysmon Event ID 1 to capture Vim child processes.
Alert on Vim writing to autostart locations, shell profile files, or SSH authorized_keys.
Forward endpoint telemetry to a centralized data lake for correlation across users who share network filesystems.

How to Mitigate CVE-2026-73078

Immediate Actions Required

Upgrade Vim to version 9.2.0840 or later on all systems, prioritizing workstations with GUI Vim installed.
Audit shared directories and archives for folder names containing Ex metacharacters before opening them in Vim.
Restrict GUI Vim use on untrusted filesystems until patches are deployed.

Patch Information

The fix is delivered in Vim patch 9.2.0840, committed in Vim commit 29c6fd0. Details are documented in the GHSA-rcr7-f3wr-22r2 advisory. The patch updates runtime/pack/dist/opt/netrw/autoload/netrw.vim to neutralize | and single-quote characters at the five affected construction sites.

Workarounds

Disable the netrw plugin by adding let g:loaded_netrwPlugin = 1 to ~/.vimrc until the patch is applied.
Avoid using the GUI Bookmarks, History, and Targets menus on directories from untrusted sources.
Use terminal Vim rather than GUI Vim where menu construction is not triggered.

bash

# Disable netrw globally in ~/.vimrc
let g:loaded_netrw       = 1
let g:loaded_netrwPlugin = 1

# Verify installed Vim version meets the fixed release
vim --version | head -n 1
# Expected: VIM - Vi IMproved 9.2 (patch 840 or later)