CVE-2026-73078

Executive Summary

CVE-2026-73078 is a command injection vulnerability (CWE-77) in the netrw file-explorer plugin bundled with the Vim text editor. All Vim versions prior to 9.2.0840 are affected: when a user browses or bookmarks a directory in GUI Vim, netrw interpolates the attacker-controlled directory path into internal :menu commands without neutralizing the | (Ex command separator) or single-quote characters, allowing a crafted path to execute arbitrary Ex and operating-system commands in the context of the Vim process. No public exploit, PoC, or CISA KEV listing was available at the time of writing; the vendor fix is released in version 9.2.0840, with patch confirmation currently attributed to a single source (OSV) at 2/4 confidence.

Technical Analysis

The vulnerability resides in the netrw plugin, loaded via runtime/plugin/netrwPlugin.vim. The plugin's core implementation lives in runtime/pack/dist/opt/netrw/autoload/netrw.vim. When operating in GUI Vim, netrw builds interactive menu entries — specifically Bookmarks, History, and Targets — to let users jump between recently browsed or frequently used locations. Those menu entries are constructed by interpolating directory path strings directly into :menu commands that Vim subsequently executes.

Per the NVD description, the following components are implicated at five distinct construction sites:

• s:NetrwBookmarkMenu() — constructs the Bookmarks menu.
• s:NetrwTgtMenu() — constructs the Targets menu (and related target-listing views).
• g:netrw_menu_escape — a helper intended to escape menu labels/arguments.
• EX_TRLBAR — the delimiter used inside executed Ex commands.
• netrw#MakeTgt() — a helper that assembles target menu entries.

None of these neutralize the | (bar) command separator or single-quote characters when embedding a directory path. The consequence is that a directory name containing a single quote followed by a bar can "break out" of the menu-argument context. Anything following the injected bar is interpreted by Vim as one or more additional Ex commands. Because Ex commands include :! (which executes an operating-system shell command), the injection primitive escalates directly from an Ex-command injection to full local operating-system command execution.

The attack surface is the directory path itself, which is an input that an attacker can control through any channel that delivers a file tree to the victim's machine: a ZIP/RAR/tarball archive, a malicious SMB/WebDAV share, a crafted git repository, an external drive, or any mounted network location. The mere act of opening such a directory in netrw (or bookmarking it, which triggers the same menu-construction path) is sufficient to trigger the flaw. This makes it a "file name / path as attack vector" client-side vulnerability rather than a remotely exploitable network service flaw. The NVD description provides no CVSS vector, so a standardized severity score is unavailable; the EPSS score of 0.00336 (26.6th percentile) indicates a low current probability of exploitation in the wild.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-73078. The attack chain below is inferred strictly from the vulnerability class (CWE-77 command injection) and the NVD description.

1. Reconnaissance / target identification. An attacker identifies users who operate GUI Vim (gvim or vim in a GUI mode) with the bundled netrw plugin — commonly developers, system administrators, and security engineers. Because the malicious input is a directory path, the attacker does not need direct network access to the victim; any delivery channel carrying a file tree suffices (e.g., phishing email with an attached archive, a poisoned shared drive, or a repository clone).

2. Triggering the flaw. The victim opens the delivered file tree and navigates to the attacker-controlled directory in netrw, or bookmarks it. Opening and bookmarking both cause netrw to rebuild the Bookmarks/History/Targets menu entries, at which point the attacker-controlled path is passed to the vulnerable menu-construction code at one or more of the five sites (s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, netrw#MakeTgt()).

3. Payload / execution method. The directory path is crafted to include a single quote and a | (bar) character, terminating the intended menu argument and appending an arbitrary Ex command sequence. For example, a path containing an injected :! (Ex "shell" command) prefix causes Vim to hand the remainder of the string to the operating-system shell. Because the path is interpolated verbatim into executed :menu commands, the injected commands are executed with the privileges of the Vim process user.

4. Post-exploitation impact. Successful exploitation yields arbitrary operating-system command execution on the victim's workstation in the context of the logged-in user. An attacker can read local source code and credentials (e.g., SSH keys, cloud tokens), install persistence mechanisms, exfiltrate data over the network, or use the compromised machine as a pivot point into the internal corporate network. Since execution happens locally inside the editor process, it will not be observed by network IDS appliances.

Detection premise for the below rules: the most reliable end-host observables are process-creation events in which vim/gvim spawns an OS shell or other child process with a suspicious command line. Log data from EDR, Sysmon, auditd, and SIEM sources is therefore the primary detection surface.

Impact Assessment

Business impact. High for affected endpoints. This is a client-side, user-interaction-dependent command injection that crosses a trust boundary (file system namespace → OS shell). Successful exploitation grants code execution with the privileges of the Vim user; on developer workstations these are frequently administrative/root-equivalent accounts.

Affected systems. Any Vim installation prior to 9.2.0840 where the netrw plugin (bundled by default) is used in GUI mode and the menu feature is enabled. This spans Linux, Windows, and macOS workstations. Headless/terminal Vim without the menu path is a lower risk surface per the description's explicit reference to "GUI Vim," but the underlying vulnerable code paths may still be reachable in other configurations.

Blast radius. Direct impact is limited to the local machine, but the realistic blast radius includes source-code compromise, credential theft (SSH agent contents, password stores, cloud CLI tokens), lateral movement via harvested credentials, and supply-chain risk if the compromised host is a build/release machine.

CVSS / exposure context. CVSS is officially N/A — no vector was published by the CNA, so no severity subscores can be decomposed. EPSS 0.00336 (26.6th percentile) indicates low exploit likelihood to date. The CVE is not listed in CISA KEV, and no threat-actor campaigns or in-the-wild exploitation evidence have been reported. This should be treated as a "patch promptly, not emergency" priority unless the organization has a high risk of receiving hostile file trees (e.g., pentest engagements, untrusted-partner deliverables, public-facing build ingestion).

Detection Guidance

Sigma Rule

title: Vim netrw Command Injection - Suspicious Shell Child Process
id: 2f0b91c7-6a4e-4d5a-9c8b-7f1a3e2d5b19
status: experimental
description: >
  Detects OS shell processes spawned by Vim/GVim, which may indicate
  exploitation of CVE-2026-73078 (netrw :menu command injection).
  The vulnerable menu construction interpolates attacker-controlled
  directory paths into executed Ex commands; a path containing
  single quotes and a "|" separator can produce arbitrary :! shell
  commands executed as child processes of the editor.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73078
author: Valters IT
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentProcessName|endswith:
      - '/vim'
      - '/gvim'
      - 'vim'
      - 'gvim'
  selection_shell:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/csh'
      - '/bin/sh'
      - '/usr/bin/env'
  filter_known_good:
    # Legitimate IDE/plugin tooling invokes shells; tune per env.
    CommandLine|contains:
      - 'man-db'
      - 'git status'
      - 'rustc'
  condition: selection_parent and selection_shell and not filter_known_good
falsepositives:
  - Legitimate Vim plugins (e.g., language tooling, tag generators) spawning shells.
level: high
tags:
  - attack.t1203
  - attack.execution
  - cve.2026-73078
  - cwe.77

YARA Rule

rule CVE_2026_73078_netrw_menu_payload
{
    meta:
        author      = "Valters IT"
        description = "Detects strings indicative of Vim netrw :menu injection payloads (CVE-2026-73078). Hunt on files that may encode malicious directory names (archives, manifests, Vim session files, netrw bookmark/history files)."
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-73078"
        date        = "2026-01-01"
        cve         = "CVE-2026-73078"

    strings:
        $s1 = ":!"                       // Ex shell command
        $s2 = "|"                        // Ex command separator (TRLBAR)
        $s3 = "'"                        // single-quote break-out
        $s4 = ":menu"                    // menu construction command
        $s5 = "netrw"                    // plugin family marker
        $s6 = "MakeTgt"                  // target-menu helper name

    condition:
        // Payload material is typically small; skip huge binaries.
        filesize < 2MB
        and 4 of them
}

Suricata IDS Rule

Network-layer detection is of limited value for this CVE because exploitation occurs entirely during local file-system browsing inside GUI Vim. The rule below is a best-effort heuristic for HTTP(S)/SMB-adjacent protocols that may carry crafted directory listings toward Vim clients. Tune or disable it in environments where no untrusted file shares are browsed.

alert http any any -> any any (
    msg:"ET CVE-2026-73078 Vim netrw Menu Injection Payload in HTTP Response";
    flow:established,to_client;
    file_data;
    content:":menu";
    nocase;
    content:":!";
    nocase;
    content:"|";
    distance:0;
    classtype:attempted-user;
    sid:202630078;
    rev:1;
    metadata:created_at 2026_01_01, updated_at 2026_01_01;
)

Elastic Detection

// EQL — runs in Elastic Security on process-creation events
process where event.type == "start"
  and process.parent.name in ("vim", "vim.exe", "gvim", "gvim.exe")
  and process.name in ("sh", "bash", "dash", "zsh", "csh", "cmd.exe", "powershell.exe", "pwsh.exe")
  and process.command_line : ("* -c *", "* /c *", "* -Command *", "*--command*", "* ; *")

Splunk SPL Query

index=* (sourcetype=WinEventLog:Security OR sourcetype=ProcessRollup2* OR sourcetype=linux_audit OR sourcetype=Bash)
| search (parent_process_name IN ("vim","gvim","vim.exe","gvim.exe"))
  AND (process_name IN ("sh","bash","dash","zsh","csh","cmd.exe","powershell.exe","pwsh.exe"))
| table _time, host, user, parent_process_name, parent_process_id, process_name, process_id, command_line
| sort - _time
| eval attack_phase="CVE-2026-73078 netrw command injection (suspected)"

Wazuh OSSEC Rule

<!--
  Wazuh rule for CVE-2026-73078 detection.
  Requires auditd execve logging (audit rule: -a always,exit -F arch=b64 -S execve -k process_execution)
  or a Windows policy that writes process-creation events (Event ID 4688) .
-->
<group name="vim,command_injection,cve_2026_73078,">
  <rule id="100731" level="12">
    <if_sid>80700</if_sid>
    <match>gvim|vim</match>
    <description>Vim/gVim process executed - possible netrw menu command injection (CVE-2026-73078)</description>
    <mitre>
      <id>T1203</id>
      <tactic>Execution</tactic>
      <technique>Exploitation for Client Execution</technique>
    </mitre>
  </rule>

  <rule id="100732" level="14">
    <if_sid>100731</if_sid>
    <regex>sh|bash|dash|zsh|cmd\.exe|powershell</regex>
    <description>Vim spawned an OS shell; high-confidence indicator of CVE-2026-73078 exploitation attempt</description>
    <group>command_injection,execution,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED). The fix is attributed to Vim 9.2.0840 and reported via a single source (OSV). OSV package metadata for this advisory still lists the package state as "unfixed" (0 → unfixed), meaning the public advisory dataset has not yet been reconciled with the claimed upstream fix. Treat the patch as provisionally confirmed and verify the deployed binary before closing the remediation ticket.

1. Immediate mitigations (before patching):

   • Upgrade GUI Vim to version 9.2.0840 or later as the primary remediation.
   • If an immediate upgrade is not possible, instruct users not to open or bookmark untrusted directory paths in GUI Vim — in particular, do not browse SMB/WebDAV shares, extracted archives from untrusted senders, or externally mounted volumes until patched.
   • Run Vim for untrusted-content review in a sandboxed virtual machine or container with no access to production credentials (SSH agent, cloud tokens, password stores).
   • Restrict outbound network mounts (SMB/NFS/WebDAV) to explicitly trusted servers and segment them from development endpoints.
   • Consider temporarily forcing Vim into non-GUI mode (-N -es, terminal-only) for users who do not require full GUI functionality, as the described attack path targets the GUI menu rendering.

2. Patch / upgrade steps:

   • Upgrade to Vim 9.2.0840 (or the current stable release) via the distribution package manager, official Vim build, or the upstream development channel: sudo apt update && sudo apt install vim-gtk3 (Debian/Ubuntu), sudo dnf upgrade vim (Fedora/RHEL), or equivalent for the platform.
   • After upgrading, confirm the version: vim --version | head -1 must report 9.2.0840 or newer.
   • Independently validate the patch: because confidence is 2/4, verify the netrw plugin's behavior against the vulnerable construction sites (e.g., confirm g:netrw_menu_escape and the menu-building helper functions are updated in runtime/pack/dist/opt/netrw/autoload/netrw.vim) or wait for an independently attributed advisory from the Vim project before closing the ticket.

3. Long-term hardening:

   • Automate Vim and editor-toolchain patching in your endpoint patch-management pipeline; track upstream Vim release notes and OSV advisories.
   • Deploy and tune the detection rules above (Sigma/EQL/SPL/Wazuh) across endpoints running Vim, with particular focus on developer and admin workstations.
   • Enable endpoint least-privilege policies so Vim rarely runs with elevated rights; consider AppArmor/SELinux profiles or OS-level sandboxing for GUI editors.
   • Train users in safe handling of archives and mounted shares; treat "browse the attachment/extracted folder" as a risky action equivalent to opening a macro-enabled document.
   • Re-evaluate EPSS and KEV status quarterly — if CVE-2026-73078 later appears in CISA KEV or a PoC is published, re-prioritize to emergency patch level across all affected endpoints.

References

1. NVD Entry — CVE-2026-73078: https://nvd.nist.gov/vuln/detail/CVE-2026-73078
2. OSV Advisory (patch source, confidence 2/4): https://osv.dev/vulnerability/CVE-2026-73078
3. Vim Project Home / Release Notes: https://www.vim.org/
4. Vim Source Repository (netrw plugin — runtime/pack/dist/opt/netrw/): https://github.com/vim/vim
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-73078 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat-actor / in-the-wild status: No known threat-actor campaigns, no in-the-wild exploit evidence, no public PoC, and no exploit code were identified as of the analysis date. The attack chain described in the Exploitation Scenarios section is inferred strictly from the CWE-77 vulnerability class and the NVD description; insufficient technical detail is available in public advisories to reconstruct a byte-level payload.