CVE-2026-73077
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In Vim before 9.2.0839, the ftplugin plugins for sh, zsh, and ps1 pass attacker-controlled Visual-mode selections to keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before invoking bash, zsh, or PowerShell, allowing arbitrary OS commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.
Risk Assessment
An attacker can execute arbitrary commands on the victim's machine if the victim opens a specially crafted file in Vim, potentially leading to system compromise or data theft.
Recommendation
Update Vim to version 9.2.0839 or later to mitigate the vulnerability.
Original NVD description (English source)
Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.