CVE-2026-73078 is a command injection flaw in the Vim netrw file browser. Directory paths are placed into menu commands without neutralizing the command separator, so a crafted path browsed or bookmarked in GUI Vim can run commands. The record scores it 8.8, High. Upgrade to Vim 9.2.0840.
What's affected
The record and the advisory both say Vim before 9.2.0840 is affected and that 9.2.0840 is the fixed patch level. The flaw spans runtime/plugin/netrwPlugin.vim and the netrw autoload script.
The advisory explains that netrw builds its Bookmarks, History and Targets menus by placing directory paths into menu commands. The escape set did not include the Ex command separator, the bar character, and two sites also placed the path into a single quoted string without handling the quote. A path that holds a bar ends the menu command, and the rest of the path runs as Ex commands, and through the bang command as operating system commands. The record names five construction sites. It says the issue applies to GUI Vim.
The weakness classes are CWE-77, command injection, and CWE-184, incomplete list of disallowed inputs.
How to check if you're exposed
Check the patch level of every Vim you run, including copies on servers, jump hosts and developer machines.
vim --version | head -3
vim --version | grep 'Included patches'
The second line prints a range such as 1 to a four digit number. The version is safe for this issue if that number is at least the fixed patch level. Linux distributions often backport fixes without changing the upstream patch number, so also check your distribution's security notes for the package. Vim is often installed by default on servers, in container base images and in CI images, so scan image contents too. The free in-browser scan at gold.safeguard.sh/scan can check a manifest for known CVEs.
Then check whether you use a graphical Vim. The advisory text limits the issue to GUI Vim, where menus exist, so terminal only Vim is a smaller concern. Check with the gvim command or your desktop launcher. Also ask whether people browse directories whose names come from outside, such as unpacked archives or shared drives.
What to do now
- Upgrade Vim to patch level 9.2.0840 or later, or install your distribution's fixed package.
- If you cannot upgrade, avoid browsing untrusted directories in GUI Vim with netrw.
- Do not bookmark paths from archives or shared locations you do not control.
- Inspect odd directory names, such as ones containing a bar character, before opening them in an editor.
- Update images and workstations that include GUI Vim.
- Record the patch level you now run.
Why it matters
File names are data that anyone can shape. A name is allowed to contain nearly any character on common systems, including characters that mean something to a command parser. Any code that builds a command from a name has to treat every special character as hostile.
The sources differ on severity. The record scores it 8.8 under CVSS 3.1 and rates it High. The Vim GitHub advisory labels it Moderate and its text says Medium. Local attack vectors and a need for user action are the reason the project rates it lower. Plan around your own use. A shared jump host where many people open files from others is a bigger risk than a single user laptop. No source reports exploitation in the wild, and the CVE is not in the CISA KEV catalog. This record gives a network attack vector and needs user interaction, which is why its score is higher than the other Vim items in this batch. The advisory text describes browsing or bookmarking a crafted path, so the practical route is a user opening something from outside.
Quick check
Which Vim builds does the issue concern?
The advisory describes GUI Vim, since the flaw is in menu construction.
What character was missing from the escape set?
The Ex command separator, the bar, according to the advisory.
Sources
Last reviewed: 18 October 2026.
