CVE-2026-73076 in Vim
Summary
by MITRE • 08/11/2026
Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability exists within the vim text editor's runtime autoload system, specifically in the vimball.vim script that handles vimball file operations. A vimball is a self-contained archive format used by vim to distribute plugins and packages, typically containing multiple files including a .VimballRecord file that tracks the installation process. The flaw occurs when processing a crafted vimball member named .VimballRecord which allows an attacker to inject malicious commands into the installation record. This represents a classic privilege escalation vulnerability where untrusted input from a vimball archive can be manipulated to execute arbitrary code with the privileges of the user running vim.
The technical implementation involves the vimball#RmVimball() function which processes the matching record entry and executes stored Ex commands through the :! command execution mechanism. This allows attackers to inject operating system commands that will execute with elevated privileges, effectively creating a remote code execution vulnerability. The vulnerability leverages the principle of command injection where user-controlled data is interpreted as executable commands rather than benign input. According to CWE-78, this maps directly to improper neutralization of special elements used in OS commands, while the privilege escalation aspect aligns with CWE-269 for insufficient privileges or permissions.
The operational impact of this vulnerability is significant as it enables attackers to execute arbitrary system commands through seemingly legitimate vimball installations. An attacker could craft a malicious vimball containing a specially named .VimballRecord file that includes dangerous commands such as system shell execution, file manipulation, or network communication. The vulnerability affects all versions prior to 9.2.0847, making it a widespread concern for users who may unknowingly install compromised vimballs from untrusted sources. Attackers could exploit this through social engineering tactics targeting vim plugin repositories or package managers that utilize vimball format.
Mitigation strategies include immediate upgrade to vim version 9.2.0847 or later, which contains the necessary patch to prevent malicious .VimballRecord files from overwriting installation records with attacker-controlled commands. Organizations should also implement strict verification processes for vimball installations, including validating source authenticity and implementing sandboxing techniques when processing untrusted vimballs. Additionally, users should avoid installing vimballs from untrusted sources and maintain awareness of the potential for malicious command injection in package management systems. The fix implements proper input validation and sanitization of the .VimballRecord file content to prevent arbitrary command execution during the installation process. This vulnerability demonstrates the importance of validating all user-supplied data within privileged contexts, particularly in development tools that execute with elevated system permissions.