CVE-2026-73078

The CVSS 8.6 rating on CVE-2026-73078 is misleading if you're triaging across a mixed environment. This is a command injection in netrw's GUI menu construction, but the exploitation path has a dependency the base score doesn't communicate: it only triggers in GUI Vim instances. The vulnerable code — where directory names interpolate into menu command strings for Bookmarks, History, and Targets — executes when GUI menus are built. In headless or TTY Vim, these code paths are never reached the same way. This changes prioritization. If your fleet runs Vim over SSH, in CI/CD pipelines, or as a server-side editor, the practical attack surface is negligible. The vector requires a user to open netrw in GUI Vim and browse a directory containing malicious path names — a specific chain that doesn't exist in terminal-only deployments. Organizations running GUI Vim as a development workstation tool face the full vector. The downstream risk amplifies on the systems where exploitation is possible. GUI Vim on developer workstations runs with access to SSH keys, cloud credentials, Git config, and network trust relationships that server-side compromises rarely touch. One successful menu injection potentially pivots to credential theft or artifact signing keys. The post-exploitation blast radius on workstations is far higher than the delivery mechanism's complexity would suggest. The implicit trust model is worth scrutinizing. Netrw ships in Vim's runtime directory — users audit third-party plugins but rarely question bundled runtime code. The vulnerability chains three reasonable assumptions (directory names are data, bundled plugins are safe, GUI menus are display-only) into a composite failure. This pattern has appeared in browsers and office suites before. Audit your runtime plugins the way you'd audit anything else; the "included by default" tier is where unexamined assumptions accumulate. Patch in 9.2.0840 addresses the specific interpolation, but the broader question remains: how many similar patterns exist in other runtime plugins that haven't been audited for GUI menu construction? Treat this as a class issue, not an isolated incident.

Reviewed through automated stages and approved by a human before publication.