CVE-2026-73073: Vim Text Editor RCE Vulnerability

CVE-2026-73073 Overview

CVE-2026-73073 is a code injection vulnerability [CWE-94] in Vim, the open source command line text editor. The flaw resides in StructMembers() within runtime/autoload/ccomplete.vim. Vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value read from a tags file. An unterminated character collection followed by a command separator lets attackers execute arbitrary Ex and operating-system commands when a user triggers C omni-completion with CTRL-X CTRL-O on a member access resolved from the malicious tags file. The issue is fixed in Vim 9.2.0845.

Critical Impact
Opening a project containing a malicious tags file and invoking C omni-completion can result in arbitrary command execution under the user's context.

Affected Products

Vim versions prior to 9.2.0845
Vim runtime file runtime/autoload/ccomplete.vim (C omni-completion)
Any environment where users invoke CTRL-X CTRL-O against untrusted tags files

Discovery Timeline

2026-08-18 - CVE-2026-73073 published to the National Vulnerability Database (NVD)
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-73073

Vulnerability Analysis

The vulnerability originates in the StructMembers() function inside runtime/autoload/ccomplete.vim. This function supports C omni-completion by searching tags files for members of a resolved type. It builds a vimgrep search pattern by interpolating the typeref: or typename: field from a tags entry directly into the command string.

Escaping is applied with escape(typename, '/\'), which only escapes forward slashes and backslashes. It does not neutralize regex metacharacters such as [. An unterminated character collection causes vimgrep's pattern-skipping logic to fail. Trailing bytes in the tag value are then parsed by Vim as Ex commands.

Execution requires user interaction: the victim must open a file in a project containing an attacker-controlled tags file and invoke C omni-completion on a member access whose type resolves via that tag. The attack vector is local, but the impact covers confidentiality, integrity, and availability because injected Ex commands can shell out to the operating system.

Root Cause

Insufficient sanitization of tag file field values before use in an Ex command. The fix switches the pattern to use Vim's very-nomagic mode with \V so the typename is matched literally, blocking metacharacter abuse.

Attack Vector

An attacker plants a crafted tags file containing a malicious typeref: or typename: value in a repository or shared directory. When a developer opens a C source file from that project and triggers omni-completion, Vim executes the embedded Ex commands.

text

       if complete_check()
         return []
       endif
+      # Match "typename" literally (\V): escaping alone is not enough, as e.g.
+      # an unclosed "[" makes vimgrep's pattern skipping fail and the rest of
+      # the tag value is then parsed as Ex commands.
       execute 'silent! keepjumps noautocmd '
-        .. n .. 'vimgrep ' .. '/\t' .. escape(typename, '/\') .. '\(\t\|$\)/j '
+        .. n .. 'vimgrep ' .. '/\t\V' .. escape(typename, '/\') .. '\m\(\t\|$\)/j '
         .. fnames
 
       qflist = getqflist()

Source: Vim commit 2f628d8104958fa7421664f792ca6d4f7a39a10f

The patch wraps the escaped typename between \V and \m so vimgrep treats the value as a literal string and correctly resumes magic matching for the tab-or-end anchor.

Detection Methods for CVE-2026-73073

Indicators of Compromise

Tags files containing unbalanced [ characters or embedded |, :, or newline sequences within typeref: or typename: fields.
Unexpected child processes spawned by the vim process shortly after a file open or omni-completion action.
Modifications to shell history, cron entries, or SSH authorized keys following a developer session in a shared repository.

Detection Strategies

Inspect tags files from untrusted sources for suspicious typename: or typeref: values containing regex metacharacters or Ex command separators.
Monitor process lineage where vim is the parent of shells (sh, bash, zsh) or interpreters not typical for editor sessions.
Compare installed Vim binaries and runtime files against the versions shipped with 9.2.0845 or later.

Monitoring Recommendations

Ingest endpoint process telemetry into a security data lake and alert on vim spawning shells or network utilities.
Track file integrity for runtime/autoload/ccomplete.vim on multi-user hosts and build servers.
Log tags file additions or modifications in shared source repositories.

How to Mitigate CVE-2026-73073

Immediate Actions Required

Upgrade Vim to version 9.2.0845 or later across all workstations, developer laptops, and build hosts.
Rebuild container images and internal Vim packages that bundle a vulnerable runtime/autoload/ccomplete.vim.
Audit shared repositories and CI workspaces for untrusted tags files and remove or regenerate them from trusted sources.

Patch Information

The fix is included in Vim 9.2.0845. It replaces the fragile escaping in StructMembers() with a very-nomagic literal match, ensuring the typename value cannot break out of the vimgrep pattern. Details are available in the GitHub Security Advisory GHSA-cx73-phcg-3j5g and the Vim 9.2.0845 release notes.

Workarounds

Avoid invoking C omni-completion (CTRL-X CTRL-O) in projects that include tags files from untrusted origins.
Regenerate tags files locally with ctags from vetted sources rather than accepting them from repositories or archives.
Disable or remove ccomplete as the omnifunc for C files until the upgrade is applied.

bash

# Verify the installed Vim version includes the fix
vim --version | head -n 2

# Temporarily disable C omni-completion until patching completes
cat >> ~/.vimrc <<'EOF'
autocmd FileType c setlocal omnifunc=
autocmd FileType cpp setlocal omnifunc=
EOF