new file mode 100644
@@ -0,0 +1,94 @@
+From 29c6fd090d4520592f8be7d9ec81190edf25ef69 Mon Sep 17 00:00:00 2001
+From: Yasuhiro Matsumoto <mattn.jp@gmail.com>
+Date: Mon, 6 Jul 2026 13:54:03 +0900
+Subject: [PATCH] patch 9.2.0840: [security]: code injection in netrw via
+ bookmarks
+
+Problem: [security]: code injection in netrw via bookmarks and history
+ (David Carliez)
+Solution: Escape the '|' explicitly (Yasuhiro Matsumoto)
+
+The bookmark and history menu builders interpolate paths into :execute'd
+:menu commands using g:netrw_menu_escape, which did not escape the Ex
+command separator '|'. A crafted path could break out of the :menu command
+and run arbitrary Ex/shell commands when the menu was built or triggered.
+
+Add '|' to g:netrw_menu_escape for the menu names, escape the :e right-hand
+side with fnameescape(), and quote the netrw#MakeTgt() argument with
+string() instead of raw single-quote interpolation.
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2
+
+Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+CVE: CVE-2026-73078
+Upstream-Status: Backport [https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69]
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ runtime/pack/dist/opt/netrw/autoload/netrw.vim | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+index 49ccebc07a..a3198dc689 100644
+--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim
++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+@@ -380,7 +380,7 @@ if has("win32")
+ else
+ call s:NetrwInit("g:netrw_glob_escape",'*[]?`{~$\')
+ endif
+-call s:NetrwInit("g:netrw_menu_escape",'.&? \')
++call s:NetrwInit("g:netrw_menu_escape",'.&? \|')
+ call s:NetrwInit("s:netrw_map_escape","<|\n\r\\\<C-V>\"")
+ if has("gui_running") && (&enc == 'utf-8' || &enc == 'utf-16' || &enc == 'ucs-4')
+ let s:treedepthstring= "│ "
+@@ -3734,13 +3734,14 @@ function s:NetrwBookmarkMenu()
+ if exists("g:netrw_bookmarklist") && g:netrw_bookmarklist != [] && g:netrw_dirhistmax > 0
+ let cnt= 1
+ for bmd in g:netrw_bookmarklist
+- let bmd= escape(bmd,g:netrw_menu_escape)
++ let ebmd= escape(bmd,g:netrw_menu_escape)
++ let fbmd= escape(fnameescape(bmd),'|')
+
+ " show bookmarks for goto menu
+- exe 'sil! menu '.g:NetrwMenuPriority.".2.".cnt." ".g:NetrwTopLvlMenu.'Bookmarks.'.bmd.' :e '.bmd."\<cr>"
++ exe 'sil! menu '.g:NetrwMenuPriority.".2.".cnt." ".g:NetrwTopLvlMenu.'Bookmarks.'.ebmd.' :e '.fbmd."\<cr>"
+
+ " show bookmarks for deletion menu
+- exe 'sil! menu '.g:NetrwMenuPriority.".8.2.".cnt." ".g:NetrwTopLvlMenu.'Bookmarks\ and\ History.Bookmark\ Delete.'.bmd.' '.cnt."mB"
++ exe 'sil! menu '.g:NetrwMenuPriority.".8.2.".cnt." ".g:NetrwTopLvlMenu.'Bookmarks\ and\ History.Bookmark\ Delete.'.ebmd.' '.cnt."mB"
+ let cnt= cnt + 1
+ endfor
+
+@@ -3756,7 +3757,8 @@ function s:NetrwBookmarkMenu()
+ let priority = g:netrw_dirhistcnt + histcnt
+ if exists("g:netrw_dirhist_{cnt}")
+ let histdir= escape(g:netrw_dirhist_{cnt},g:netrw_menu_escape)
+- exe 'sil! menu '.g:NetrwMenuPriority.".3.".priority." ".g:NetrwTopLvlMenu.'History.'.histdir.' :e '.histdir."\<cr>"
++ let ehistdir= escape(fnameescape(g:netrw_dirhist_{cnt}),'|')
++ exe 'sil! menu '.g:NetrwMenuPriority.".3.".priority." ".g:NetrwTopLvlMenu.'History.'.histdir.' :e '.ehistdir."\<cr>"
+ endif
+ let first = 0
+ let cnt = ( cnt - 1 ) % g:netrw_dirhistmax
+@@ -7104,7 +7106,7 @@ function s:NetrwTgtMenu()
+ let tgtdict[bmd]= cnt
+ let ebmd= escape(bmd,g:netrw_menu_escape)
+ " show bookmarks for goto menu
+- exe 'sil! menu <silent> '.g:NetrwMenuPriority.".19.1.".cnt." ".g:NetrwTopLvlMenu.'Targets.'.ebmd." :call netrw#MakeTgt('".bmd."')\<cr>"
++ exe 'sil! menu <silent> '.g:NetrwMenuPriority.".19.1.".cnt." ".g:NetrwTopLvlMenu.'Targets.'.ebmd." :call netrw#MakeTgt(".escape(string(bmd),'|').")\<cr>"
+ let cnt= cnt + 1
+ endfor
+ endif
+@@ -7122,7 +7124,7 @@ function s:NetrwTgtMenu()
+ endif
+ let tgtdict[histentry] = histcnt
+ let ehistentry = escape(histentry,g:netrw_menu_escape)
+- exe 'sil! menu <silent> '.g:NetrwMenuPriority.".19.2.".priority." ".g:NetrwTopLvlMenu.'Targets.'.ehistentry." :call netrw#MakeTgt('".histentry."')\<cr>"
++ exe 'sil! menu <silent> '.g:NetrwMenuPriority.".19.2.".priority." ".g:NetrwTopLvlMenu.'Targets.'.ehistentry." :call netrw#MakeTgt(".escape(string(histentry),'|').")\<cr>"
+ endif
+ let histcnt = histcnt + 1
+ endwhile
+--
+2.50.1
+
@@ -55,6 +55,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
file://CVE-2026-73073.patch \
file://CVE-2026-73074.patch \
file://CVE-2026-73077.patch \
+ file://CVE-2026-73078.patch \
"
PV .= ".1683"
Pick the patch from [1], also referenced in the NVD report [2]. [1] https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-73078 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> --- .../vim/files/CVE-2026-73078.patch | 94 +++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 95 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-73078.patch