Executive brief
Vim is a widely-used text editor with a built-in file browser (netrw) that constructs menu entries from directory paths. When a user browses or bookmarks directories with specially crafted names, those names can be interpreted as executable commands, allowing an attacker to run arbitrary code with the user's privileges. This affects only the GUI version of Vim with the menu bar enabled.
Technical details
The vulnerability is a command injection flaw (CWE-94, CWE-184) in netrw's menu construction code. Functions s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), and related code build :menu commands by concatenating user-controlled directory paths without properly escaping the pipe character (|) which terminates Ex commands, and in some cases without escaping single quotes embedded in strings. An attacker can craft a directory path containing | or ' characters to inject arbitrary Ex commands and, via :!, arbitrary OS commands. Attack requires GUI Vim with menus enabled (defaults) and the victim browsing or bookmarking an attacker-controlled path. The issue is fixed in version 9.2.0840.
Affected products
- Vim Vim prior to 9.2.0840
Timeline
- 2026-07-23: disclosed: GHSA-rcr7-f3wr-22r2 published
- 2026-08-11: patched: Vim 9.2.0840 released with fix (commit 29c6fd0)