CVE-2026-73073
Received Received - Intake

Vim 9.2.0845 Command Injection via Ctags Member Completion

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-08
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-73073
EUVD
EUVD-2026-60975

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vim vim 9.2.0845

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Vim versions prior to 9.2.0845 allows arbitrary Ex command execution during C omni-completion. It occurs when a tags file contains a typeref field with special characters like an unclosed bracket. This bypasses insufficient escaping, enabling command injection via a pipe symbol during member access completion.

Detection Guidance

To detect this vulnerability, check your Vim version with 'vim --version'. If it is below 9.2.0845, the system is vulnerable. Additionally, inspect tags files for entries with typeref fields containing special characters like unclosed brackets or pipes, which could indicate malicious content.

Impact Analysis

An attacker could craft a malicious tags file to execute arbitrary commands on your system when you use C omni-completion. This requires you to have filetype plugins enabled and invoke omni-completion on a member access using a crafted tags file.

Compliance Impact

This vulnerability allows arbitrary command execution on a user's system when they invoke C omni-completion in Vim. For compliance standards like GDPR or HIPAA, this could lead to unauthorized access or data exfiltration if exploited, potentially violating data protection requirements. The attack requires specific conditions but could enable attackers to run malicious commands on affected systems.

Mitigation Strategies

Upgrade Vim to version 9.2.0845 or later immediately. Disable filetype plugins temporarily if upgrading is not possible, but this may impact functionality. Remove or sanitize any untrusted tags files that may contain malicious typeref entries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73073. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart