CVE-2026-73073: Vim: Arbitrary Ex Command Execution in C Omni-Completion
Last updated 25 August 2026
Other sources
Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.2.0858-1 - Upgrade
Upgrade
Vimto a version that resolves this vulnerability.Fixed in 9.2.0845
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users of Vim versions before 9.2.0845 are exposed when they use C omni-completion with CTRL-X CTRL-O and the member type is resolved from a tags file containing an attacker-controlled typeref: or typename: value.
What is required for exploitation?
An attacker needs to cause Vim to use a crafted tags file and induce or wait for the user to invoke C omni-completion on a relevant member access. The crafted type value must contain an unterminated collection followed by a command separator.
What should be done if patching cannot happen immediately?
Upgrade Vim to version 9.2.0845. If upgrading is not immediately possible, avoid invoking C omni-completion against code whose type information may be resolved from untrusted tags files.