Skip to content
OpenAdvisories
High · 8.6 CVE-2026-73078 EUVD-2026-56234

Vim: Arbitrary Code Execution via Netrw Menu Construction

Published Aug 11, 2026 · Updated Aug 11, 2026 · Assigned by GitHub_M

Vendor: vim Product: vim Package: vim Package: vim Package: vim Package: vim Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.

Affected products

VendorProductAffectedFixed
vim vim < 9.2.0840 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 vim 2:9.2.0858-1 —
Debian 13 vim 2:9.1.1230-2+deb13u1 —
Debian 12 vim No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS vim 2:9.1.2141-1ubuntu4.8 USN-8657-1
Ubuntu 24.04 LTS vim 2:9.1.0016-1ubuntu7.19 USN-8657-1
Ubuntu 22.04 LTS vim 2:8.2.3995-1ubuntu2.35 USN-8657-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS vim 2:8.1.2269-1ubuntu5.32+esm12 USN-8657-1
Ubuntu Pro 18.04 LTS vim 2:8.0.1453-1ubuntu1.13+esm23 USN-8657-1
Ubuntu Pro 16.04 LTS vim 2:7.4.1689-3ubuntu1.5+esm38 USN-8657-1
Ubuntu Pro 14.04 LTS vim 2:7.4.052-1ubuntu3.1+esm32 USN-8657-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 vim +3 2:9.1.083-9.el10_2.20 RHSA-2026:66336
RHEL 9 vim +3 2:8.2.2637-26.el9_8.21 RHSA-2026:66366
RHEL 8 vim +3 2:8.0.1763-31.el8_10.7 RHSA-2026:66348
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.6 EUS vim +5 2:8.2.2637-22.el9_6.4 RHSA-2026:70818
RHEL 9.4 E4S vim +5 2:8.2.2637-20.el9_4.4 RHSA-2026:72465
RHEL 9.2 E4S vim +5 2:8.2.2637-20.el9_2.3 RHSA-2026:72466
RHEL 7 ELS vim +4 2:7.4.629-8.el7_9.2 RHSA-2026:68711

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 xxd +6 2:9.1.083-9.el10_2.20 ALSA-2026:66336
AlmaLinux 9 vim-X11 +4 2:8.2.2637-26.el9_8.21 ALSA-2026:66366
AlmaLinux 8 vim-X11 +4 2:8.0.1763-31.el8_10.7 ALSA-2026:66348

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 vim 2:9.1.083-9.el10_2.20 RLSA-2026:66336
Rocky Linux 9 vim 2:8.2.2637-26.el9_8.21 RLSA-2026:66366
Rocky Linux 8 vim 2:8.0.1763-31.el8_10.7 RLSA-2026:66348

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 vim 9.2.0957-150500.20.64.1 SUSE-SU-2026:3680-1
SLES 15 SP6 vim 9.2.0957-150500.20.64.1 SUSE-SU-2026:3680-1
SLES 15 SP5 vim 9.2.0957-150500.20.64.1 SUSE-SU-2026:3680-1
SLES 15 SP4 vim 9.2.0957-150000.5.102.1 SUSE-SU-2026:3679-1
SLES 12 SP5 vim 9.2.0957-17.76.1 SUSE-SU-2026:3677-1
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 vim 9.2.0957-160000.1.1 SUSE-SU-2026:23552-1
SLES for SAP 15 SP6 vim 9.2.0957-150500.20.64.1 SUSE-SU-2026:3680-1
SLES for SAP 15 SP5 vim 9.2.0957-150500.20.64.1 SUSE-SU-2026:3680-1
SLES for SAP 15 SP4 vim 9.2.0957-150000.5.102.1 SUSE-SU-2026:3679-1
SLES 16.0 vim 9.2.0957-160000.1.1 SUSE-SU-2026:23552-1
SLE Micro 6.2 vim 9.2.0957-160000.1.1 SUSE-SU-2026:23393-1, SUSE-SU-2026:23391-1
SLE Micro 6.1 vim 9.2.0957-slfo.1.1_1.1 SUSE-SU-2026:23190-1
SLE Micro 6.0 vim 9.2.0957-1.1 SUSE-SU-2026:23365-1
SLE Micro 5.5 vim 9.2.0957-150500.20.64.1 SUSE-SU-2026:3680-1
SLE Micro 5.4 vim 9.2.0957-150000.5.102.1 SUSE-SU-2026:3679-1
SLE Micro 5.3 vim 9.2.0957-150000.5.102.1 SUSE-SU-2026:3679-1
SLE HPC 15 SP5 vim 9.2.0957-150500.20.64.1 SUSE-SU-2026:3680-1
SLE HPC 15 SP4 vim 9.2.0957-150000.5.102.1 SUSE-SU-2026:3679-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 vim 9.2.0957-160000.1.1 openSUSE-SU-2026:21671-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 vim 9.2.0843-r0 —
Alpine v3.23 vim 9.2.0854-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 xxd +6 2:9.2.920-1.amzn2023.0.1 ALAS2023-2026-2108
Amazon Linux 2 xxd +6 2:9.0.2153-1.amzn2.0.10 ALAS2-2026-3882

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 vim 9.2.0957-1 —

Advisories 26

References