Command Line Text Editor Vulnerability in Vim
CVE-2026-73077

8.4HIGH

Key Information:

Vendor

Vim

Status
Vim
Vendor
CVE Published:
11 August 2026

What is CVE-2026-73077?

Vim, the popular open-source command line text editor, is vulnerable to an arbitrary command execution issue prior to version 9.2.0839. This vulnerability arises from the mishandling of user-controlled Visual-mode selections, which are passed unfiltered to shell commands. Specifically, the affected filetype plugins for shell, zsh, and PowerShell fail to properly neutralize shell metacharacters, enabling an attacker to execute arbitrary commands with the privileges of the user running Vim. The flaw has been addressed in the latest version, enhancing the security of the application.

Affected Version(s)

vim < 9.2.0839

References

https://github.com/vim/vim/security/advisories/GHSA-r5v6-...
x_refsource_CONFIRM
https://github.com/vim/vim/commit/c5a82fe013e73c98004ad7c...
x_refsource_MISC

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.