CVE-2026-73073 in Vim
Summary
by MITRE • 08/18/2026
Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/18/2026
Vim, a widely used open-source command-line text editor, contains a critical security vulnerability within its C language omni-completion feature prior to version 9.2.0845. The flaw resides specifically in the StructMembers() function located in the runtime/autoload/ccomplete.vim script. This component is responsible for parsing tags files to resolve type information and provide intelligent code completion suggestions when developers are writing C or C++ code. Under normal operation, this feature enhances productivity by automatically suggesting struct members based on context. However, the underlying implementation fails to properly sanitize input derived from external tag definitions before using it in command construction.
The technical root cause of this vulnerability is an insufficient escaping mechanism for typeref and typename values extracted from tags files. When a user invokes C omni-completion using the CTRL-X CTRL-O key sequence on a member access expression, Vim attempts to resolve the type by searching through associated tag files. If these tag files contain maliciously crafted entries where the typeref or typename fields are not properly escaped, the resulting vimgrep command constructed internally becomes malformed. Specifically, an attacker can craft a tags file entry that includes an unterminated collection followed by a command separator character. This structural manipulation breaks out of the intended search context and allows subsequent text to be interpreted as executable commands rather than data strings.
This flaw leads to a severe impact involving arbitrary code execution on the host operating system. Because Vim executes these constructed vimgrep commands with Ex privileges, which can include shell escapes or direct command invocation depending on configuration, an attacker who controls the tags file used during completion can force Vim to execute arbitrary Ex commands and operating-system level instructions. This typically occurs when a victim opens a project that includes a compromised tags file and triggers omni-completion in a context where the malicious type is resolved. The execution happens automatically as part of the editor's normal workflow, requiring no additional user interaction beyond initiating the completion request for the specific variable or member associated with the poisoned tag entry.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command Operation and CWE-94 Improper Control of Generation of Code (Code Injection). It also maps to MITRE ATT&CK techniques related to command execution via compromised software components or configuration files. The attack vector relies on the victim's trust in their development environment's auxiliary data, such as tags files generated by tools like ctags. This represents a supply chain risk where malicious actors can embed exploits within standard project metadata rather than directly modifying source code binaries.
Mitigation strategies primarily involve upgrading to Vim version 9.2.0845 or later, which includes patches that properly escape typeref and typename values before they are incorporated into vimgrep commands. For environments unable to upgrade immediately, administrators should enforce strict validation of tags files used in development workflows. Developers must avoid using untrusted sources for ctags data and ensure that project metadata is generated from verified source code repositories. Additionally, disabling automatic execution features or restricting the use of omni-completion on external projects can reduce exposure until patches are applied. Regular auditing of auxiliary editor configuration files remains essential to prevent similar injection vectors in other plugins or scripts within the Vim ecosystem.