CVE-2026-73077: Vim: Arbitrary Code Execution via Shell Keyword Lookup
Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATHESCCHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.
Other sources
Vim: Arbitrary Code Execution via Shell Keyword Lookup
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.0957-1 - Upgrade
Upgrade
Vimto a version that resolves this vulnerability.Fixed in 9.2.0839
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73077?
The severity of CVE-2026-73077 is rated at 77, indicating a high risk of exploitation.
How do I fix CVE-2026-73077?
To fix CVE-2026-73077, upgrade to Vim version 9.2.0839 or later.
Who is affected by CVE-2026-73077?
Users of Vim versions prior to 9.2.0839 are affected by CVE-2026-73077.
What type of vulnerability is CVE-2026-73077?
CVE-2026-73077 is classified as an OS Command Injection vulnerability.
What components of Vim are involved in CVE-2026-73077?
The vulnerability involves the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins.