Command Injection Vulnerability in Vim Text Editor
CVE-2026-73078

8.6HIGH

Key Information:

Vendor

Vim

Status
Vim
Vendor
CVE Published:
11 August 2026

What is CVE-2026-73078?

Vim, a widely used open-source command line text editor, is susceptible to a command injection vulnerability due to insecure handling of user-supplied directory paths in its netrw plugin prior to version 9.2.0840. The improper filtering allows attackers to manipulate executed menu commands by injecting malicious paths, leading to the execution of arbitrary Ex and operating system commands. This security issue highlights the importance of safeguarding user input in plugins and has been addressed in the latest version of Vim.

Affected Version(s)

vim < 9.2.0840

References

https://github.com/vim/vim/security/advisories/GHSA-rcr7-...
x_refsource_CONFIRM
https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d...
x_refsource_MISC

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.