CVE-2026-73077 in Vim
Summary
by MITRE • 08/11/2026
Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability exists within the Vim text editor's filetype plugins for shell scripting languages including bash, zsh, and powershell. The flaw resides in how these plugins handle visual-mode selections when processing keywordprg commands through the K key binding. When users select text in visual mode and press K, the system invokes shell commands without proper argument sanitization. This creates a command injection vulnerability that can be exploited by malicious actors who craft specially formatted input to manipulate the underlying shell execution processes.
The technical root cause involves the improper handling of shell arguments within the ftplugin files for sh.vim, zsh.vim, and ps1.vim. These plugins fail to properly escape or sanitize user-controlled input before passing it to shell commands through the keywordprg functionality. The absence of proper argument separation mechanisms means that shell metacharacters present in attacker-controlled text selections can be interpreted by the shell during command execution. This vulnerability is categorized under CWE-78 as improper neutralization of special elements used in OS commands, which represents one of the most critical categories of injection flaws.
The operational impact of this vulnerability extends beyond simple command execution as it allows arbitrary code to run with the privileges of the user running Vim. Since Vim is often used for editing system configuration files and scripts, an attacker who successfully exploits this vulnerability can potentially escalate privileges or gain unauthorized access to system resources. The issue affects all versions prior to 9.2.0839, making it a widespread concern for users who have not updated their installations. This type of vulnerability aligns with ATT&CK technique T1059.001 for command and scripting interpreter execution, where adversaries leverage legitimate system tools to execute malicious code.
The fix implemented in version 9.2.0839 addresses this issue by properly implementing argument sanitization mechanisms within the affected filetype plugins. The solution involves ensuring that fnameescape() and PATH_ESC_CHARS functions correctly neutralize shell metacharacters before shell commands are invoked through ShKeywordPrg, ZshKeywordPrg, or GetHelp functions. This remediation follows established security practices for preventing command injection vulnerabilities and aligns with industry standards for secure coding. Users should immediately update to version 9.2.0839 or later to protect against exploitation attempts targeting this vulnerability.
Security practitioners should note that this vulnerability demonstrates the importance of proper input validation and sanitization in text editors and development tools. The attack surface is particularly concerning given that Vim is frequently used in server environments and system administration tasks where privilege escalation opportunities exist. Organizations should conduct inventory checks to identify systems running vulnerable versions of Vim and ensure all installations are updated with the latest security patches. The vulnerability also highlights the need for regular security assessments of widely-used open source tools, as these applications often serve as targets for attackers seeking to exploit common software flaws across multiple environments.
This issue represents a classic example of how seemingly innocuous functionality can create significant security risks when proper sanitization is omitted from critical code paths. The combination of visual mode selection handling with keywordprg execution creates an attack vector that requires careful attention to argument separation and shell metacharacter handling. The remediation approach taken in the patched version demonstrates proper secure coding practices that should be applied across similar functionality in other software components where shell commands are invoked with user-supplied data.