CVE-2026-73073: 
Vim vulnerability analysis and mitigation

CVE-2026-73073 is an arbitrary Ex command execution vulnerability in Vim's C omni-completion component, affecting all versions prior to 9.2.0845. The flaw exists in runtime/autoload/ccomplete.vim, where the StructMembers() function constructs a :vimgrep command using insufficiently escaped typeref: or typename: values from a tags file, enabling injection of arbitrary Ex and OS commands. It was reported by researcher Threonine, disclosed via GitHub Security Advisory GHSA-cx73-phcg-3j5g on July 24, 2026, and patched in Vim v9.2.0845. The vulnerability carries a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory).

The root cause is improper control of code generation (CWE-94) combined with inclusion of functionality from an untrusted control sphere (CWE-829). In StructMembers(), the typename value sourced from a tags file's typeref: or typename: extension field is inserted into a :vimgrep command via :execute, with only / and \ escaped. An attacker can craft a tags file entry whose type value contains an unclosed bracket ([), causing Vim's pattern-skipping logic to fail; the command parser then treats the first subsequent | as a command separator, executing whatever follows as an Ex command. This is a bypass of the earlier partial fix in patch v9.2.0735 (GHSA-mf92-v4xw-j45x), which only blocked injection via the pattern delimiter character. The fix uses \V (very nomagic mode) to match the field literally, preventing any regex metacharacter from affecting pattern parsing (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to execute arbitrary Ex commands and, through commands such as :!, arbitrary operating-system commands in the context of the user running Vim. This results in high confidentiality, integrity, and availability impact on the victim's system. An attacker who can supply a malicious tags file (e.g., via a cloned repository or unpacked archive) can achieve full local code execution once the victim performs C omni-completion on an affected member access (GitHub Advisory).

Exploitation requires local access in the sense that the attacker must be able to place a crafted tags file in a location Vim will read, and the victim must actively invoke C omni-completion (CTRL-X CTRL-O) on a member access whose type is resolved from that tags file. No privileges are required from the attacker, but user interaction is necessary. As of the disclosure date, no in-the-wild exploitation has been reported, no exploit kits are known to include this vulnerability, and the EPSS score is 0.0. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Craft a malicious tags file: Create a tags file with an entry whose typeref: or typename: field contains an unclosed bracket followed by a command separator and an Ex command payload, e.g.:

   myvar\tmain.c\t/^x$/;"\tv\ttyperef:struct:[|call system('touch /tmp/pwned')|####

2. Deliver the tags file: Place the malicious tags file in a directory that the victim will open in Vim — for example, by including it in a source code repository, archive, or project directory that the victim clones or extracts.
3. Wait for victim to open a C file: The victim must open a C source file from the affected directory with filetype plugins enabled (the default in most Vim distributions), which sets omnifunc=ccomplete#Complete.
4. Trigger omni-completion: The victim types a member access expression (e.g., myvar.) and invokes C omni-completion with CTRL-X CTRL-O. If the type of myvar is not declared in the current buffer, Vim consults the tags file.
5. Command injection executes: StructMembers() builds a :vimgrep command containing the malicious typeref: value. The unclosed [ causes pattern skipping to fail; the | is treated as a command separator, and the injected Ex command (e.g., call system(...)) executes as the victim user. The leading :silent! suppresses any visible error (GitHub Advisory, Fix Commit).

• File System: Unexpected files created or modified in /tmp or other writable directories shortly after a Vim session involving C omni-completion; presence of a tags file in a project directory with typeref: or typename: fields containing [, |, or shell command strings.
• Process: Unusual child processes spawned by the Vim process (e.g., sh, bash, touch, curl, wget, python) during or immediately after an editing session.
• Logs: Shell history or audit logs (e.g., auditd) showing OS commands executed under the user's account at times correlating with Vim usage; system call traces showing execve calls originating from a Vim process.

The Vim project has released a fix in version 9.2.0845, which changes the :vimgrep pattern construction in StructMembers() to use \V (very nomagic) mode, ensuring the typeref:/typename: value is matched literally and cannot affect pattern parsing. Users should upgrade to Vim 9.2.0845 or later as the primary remediation. As a workaround, users can disable filetype plugins (:filetype plugin off) or avoid invoking C omni-completion (CTRL-X CTRL-O) on untrusted codebases until patched (GitHub Advisory, Vim Release).

The Vim project maintainer Christian Brabandt published the security advisory and tagged the fix release on July 24, 2026. The issue was reported by researcher Threonine and is noted as a bypass of a prior partial fix (patch v9.2.0735). No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified at this time (GitHub Advisory).