CVE-2026-73073: 
Vim vulnerability analysis and mitigation

CVE-2026-73073 is an arbitrary Ex command execution vulnerability in Vim's C omni-completion component, affecting all versions prior to 9.2.0845. The StructMembers() function in runtime/autoload/ccomplete.vim constructs a :vimgrep command using insufficiently escaped typeref: or typename: values from a tags file, enabling injection of arbitrary Ex and OS commands. It was reported by researcher Threonine, disclosed on July 23–24, 2026, and fixed in Vim v9.2.0845. The vulnerability carries a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory).

The root cause is improper control of code generation (CWE-94) combined with inclusion of functionality from an untrusted control sphere (CWE-829). The StructMembers() function in ccomplete.vim builds a :vimgrep command by embedding the typeref: or typename: field from a tags file entry, escaping only the pattern delimiter (/) and backslash (\). An attacker can craft a tags file entry whose type value contains an unclosed bracket ([), which causes Vim's pattern-skipping logic to fail; the command parser then falls back to the start of the argument and treats the first unescaped pipe (|) as a command separator, executing whatever follows as an Ex command. The :silent! prefix suppresses any visible error, making the injection stealthy. This is a bypass of the earlier partial fix in patch v9.2.0735 (GHSA-mf92-v4xw-j45x), which only blocked injection via the pattern delimiter character (GitHub Advisory, Fix Commit).

Successful exploitation allows arbitrary Ex command execution and, through commands such as :!, arbitrary operating-system command execution in the context of the user running Vim. An attacker who can supply a malicious tags file (e.g., via a cloned repository or unpacked archive) can achieve full code execution on the victim's workstation, potentially leading to data exfiltration, credential theft, or further lateral movement within the environment. Confidentiality, integrity, and availability of the affected system are all rated High impact (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is approximately 0.149%, indicating low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction — specifically, the victim must open a C file from a tree containing the malicious tags file and invoke omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. The attack vector is local, and the attack requires the presence of a crafted tags file under attacker control (GitHub Advisory, Feedly).

1. Craft a malicious tags file: Create a tags file entry where the typeref: or typename: field contains an unclosed bracket followed by a pipe and an Ex command payload, e.g.:

   myvar\tmain.c\t/^x$/;"\tv\ttyperef:struct:[|call system('malicious_command')|####

2. Deliver the tags file: Place the malicious tags file in a project directory that the victim is likely to open (e.g., a cloned Git repository, a distributed source archive, or a shared development environment).
3. Wait for victim to open a C file: The victim must open a C source file from the project tree with filetype plugins enabled (the default in most Vim distributions via runtime/defaults.vim).
4. Trigger omni-completion: The victim invokes C omni-completion with CTRL-X CTRL-O on a member access expression (e.g., myvar.) whose type is not declared in the current buffer, causing Vim to consult the tags file.
5. Command injection executes: StructMembers() builds the :vimgrep command with the malicious typeref: value; the unclosed [ causes pattern-skipping to fail, and the | is treated as a command separator, executing the injected Ex/OS command silently (GitHub Advisory, Fix Commit).

• File System: Presence of a tags file in a project directory containing typeref: or typename: fields with unusual characters such as [, |, or shell command strings; unexpected files created by the Vim process (e.g., sentinel files, scripts, or executables in temp directories).
• Process: Unusual child processes spawned by the Vim process (e.g., sh, bash, curl, wget, python) immediately following a user's use of omni-completion in a C file.
• Logs: Shell history or audit logs showing commands executed under the user's account at the time of Vim omni-completion usage; auditd records of execve calls originating from the Vim process.

Upgrade Vim to version 9.2.0845 or later, which fixes the vulnerability by matching the typeref:/typename: field literally using Vim's \V (very nomagic) mode, preventing any regex metacharacter in the tag value from affecting pattern parsing (Fix Commit, Vim Release). As a workaround, users can disable filetype plugins (:filetype plugin off) to prevent the C omni-completion function from being installed, or avoid invoking CTRL-X CTRL-O on C files from untrusted project trees. Distribution-specific patches are available for Amazon Linux 2, Amazon Linux 2023, Alpine Linux, and Mageia (AWS AL2023 Advisory, AWS AL2 Advisory).

The vulnerability was reported by researcher Threonine and acknowledged by the Vim project maintainer Christian Brabandt, who coordinated the fix with Yasuhiro Matsumoto. The Yocto Project security mailing list discussed the issue in the context of embedded Linux distributions. No significant broader media coverage or notable social media reactions have been identified beyond standard distribution advisory channels (GitHub Advisory).