CVE-2026-73077: Vim Text Editor RCE Vulnerability

CVE-2026-73077 Overview

CVE-2026-73077 is a command injection vulnerability in Vim, the open source command line text editor. Versions prior to 9.2.0839 ship filetype plugins for shell, zsh, and PowerShell files that pass Visual-mode selections through keywordprg without safely escaping shell metacharacters. When a user presses K over attacker-controlled content, the plugins invoke bash, zsh, or PowerShell with unsafely concatenated arguments. This allows arbitrary operating system commands to run with the privileges of the user editing the file. The flaw is tracked as [CWE-78] OS Command Injection and is fixed in Vim 9.2.0839.

Critical Impact
A user opening a crafted shell, zsh, or PowerShell file in Vim and pressing K on selected text can trigger arbitrary command execution under their account.

Affected Products

Vim versions prior to 9.2.0839
runtime/ftplugin/sh.vim filetype plugin
runtime/ftplugin/zsh.vim and runtime/ftplugin/ps1.vim filetype plugins

Discovery Timeline

2026-08-11 - CVE-2026-73077 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73077

Vulnerability Analysis

The vulnerability lives in three Vim filetype plugins: sh.vim, zsh.vim, and ps1.vim. Each plugin defines a keywordprg handler (ShKeywordPrg, ZshKeywordPrg, and GetHelp) that runs when the user presses K in Normal or Visual mode. The handler takes the highlighted word or selection and passes it to an external interpreter — bash, zsh, or PowerShell — for help lookup.

The plugins rely on fnameescape() and PATH_ESC_CHARS to sanitize the argument. Neither function neutralizes shell metacharacters such as `, $(), ;, |, or &. As a result, a Visual-mode selection containing shell syntax is interpreted by the invoked shell rather than treated as a literal keyword.

Because execution occurs in the context of the Vim process, an attacker who can influence the contents of a file the victim opens can achieve local code execution when the victim triggers K.

Root Cause

The root cause is improper argument separation when invoking external shells. fnameescape() is designed to escape characters significant to Vim's own command parser, not to shell interpreters. The fix in patch 9.2.0839 passes the K argument as a list to the shell command, which prevents the shell from re-parsing metacharacters.

Attack Vector

Exploitation requires local user interaction. An attacker crafts a shell script, zsh script, or PowerShell file containing malicious tokens. The victim opens the file in Vim, visually selects the crafted text, and presses K. Vim invokes the appropriate shell with the unescaped selection, and the embedded commands execute.

text

"              2024 May 23 by Riley Bruins <ribru17@gmail.com> ('commentstring')
"              2024 Sep 19 by Konfekt (simplify keywordprg #15696)
"              2025 Jul 22 by phanium (use :hor term #17822)
+"              2026 Jul 10 by Vim Project (quote K argument, prevent command injection)

" Only do this when not done yet for this buffer
if exists("b:did_ftplugin") | finish | endif

Source: GitHub commit c5a82fe — patch header entry added to runtime/ftplugin/ps1.vim documenting the command injection fix.

text

"			2024 Dec 29 by Vim Project (improve setting shellcheck compiler)
"			2025 Mar 09 by Vim Project (set b:match_skip)
"			2025 Jul 22 by phanium (use :hor term #17822)
+"			2026 Jul 10 by Vim Project (pass K argument as a list, prevent shell injection)

if exists("b:did_ftplugin")
  finish

Source: GitHub commit c5a82fe — corresponding entry in runtime/ftplugin/sh.vim noting the argument is now passed as a list.

Detection Methods for CVE-2026-73077

Indicators of Compromise

Unexpected child processes of vim such as bash -c, zsh -c, or powershell invoked with metacharacters in the argument string.
Shell history entries referencing keyword lookup commands executed from within a Vim session.
Files with .sh, .zsh, or .ps1 extensions containing unusual content in identifier positions, such as backticks or $() sequences intended to be selected.

Detection Strategies

Monitor process creation events where the parent process is vim and the child is a shell interpreter with -c and arguments containing shell metacharacters.
Alert on Vim spawning interpreters that then execute network utilities such as curl, wget, nc, or Invoke-WebRequest.
Inventory installed Vim versions across endpoints and flag hosts running versions prior to 9.2.0839.

Monitoring Recommendations

Enable command-line auditing on Linux (auditdexecve rules) and PowerShell script block logging on Windows to capture the full argument passed to the invoked shell.
Correlate vim parent-process events with outbound network connections to detect post-exploitation staging.
Review EDR telemetry for shell spawns from interactive editor sessions in developer and administrator accounts.

How to Mitigate CVE-2026-73077

Immediate Actions Required

Upgrade Vim to version 9.2.0839 or later on all systems where users open untrusted shell, zsh, or PowerShell files.
Audit shared developer workstations, build servers, and jump hosts for outdated Vim installations bundled with the operating system.
Instruct users to avoid pressing K on selections within untrusted files until the patch is applied.

Patch Information

The fix is committed as patch 9.2.0839 in the Vim repository. The patch modifies runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim to pass the K argument as a list, preventing the shell from re-interpreting metacharacters. See the GitHub Security Advisory GHSA-r5v6-q6j8-8qw2 and the upstream commit c5a82fe.

Workarounds

Disable or remove the vulnerable filetype plugins by adding let g:loaded_sh_ftplugin = 1, let g:loaded_zsh_ftplugin = 1, and let g:loaded_ps1_ftplugin = 1 to ~/.vimrc.
Override keywordprg for the affected filetypes with setlocal keywordprg=:help in an after/ftplugin/ file to route lookups through Vim's internal help rather than an external shell.
Open untrusted files with vim -u NONE -N to skip filetype plugin loading when review is required before patching.

bash

# Verify installed Vim version and confirm the fix is present
vim --version | head -n 2

# Optional workaround: disable vulnerable ftplugins in ~/.vimrc
cat >> ~/.vimrc <<'EOF'
let g:loaded_sh_ftplugin = 1
let g:loaded_zsh_ftplugin = 1
let g:loaded_ps1_ftplugin = 1
EOF