🚨High - Vim netrw Command Injection via Crafted Directory Paths (CVE-2026-73078) In Vim before 9.2.0840, the netrw file browser builds Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. Five construction sites fail to neutralize the | command separator and single quotes, so a crafted path that is browsed or bookmarked in GUI Vim can execute arbitrary Ex and operating-system commands. The payload can be delivered in something as simple as a directory with a malicious name, but it requires the user to actively browse or bookmark that path in GUI Vim, so it is not fully automatic. The impact when it triggers is full command execution. 👉Upgrade Vim to 9.2.0840.
Post summary
A high‑severity command injection vulnerability in Vim’s netrw file browser has been disclosed, allowing attackers to execute arbitrary commands via specially crafted directory names; users are urged to upgrade to Vim 9.2.0840 to remediate.