CVE-2026-73073: Vim: Arbitrary Ex Command Execution in C Omni-Completion
Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.0845
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users of Vim versions before 9.2.0845 are exposed when they use C omni-completion with CTRL-X CTRL-O and the member type is resolved from a tags file containing an attacker-controlled typeref: or typename: value.
What is required for exploitation?
An attacker needs to cause Vim to use a crafted tags file and induce or wait for the user to invoke C omni-completion on a relevant member access. The crafted type value must contain an unterminated collection followed by a command separator.
What should be done if patching cannot happen immediately?
Upgrade Vim to version 9.2.0845. If upgrading is not immediately possible, avoid invoking C omni-completion against code whose type information may be resolved from untrusted tags files.