CVE-2026-73077

EUVD-2026-56233

11.08.2026, 16:17

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.

OS Command Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
GitHub_M	CNA	8.4 HIGH	LOCAL	LOW	NONE	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 2.75%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
vim	vim	𝑥 < 9.2.839	CNA

Debian Releases

Debian Product

Codename

vim

bookworm	vulnerable
forky	2:9.2.0858-1 fixed
sid	2:9.2.0858-1 fixed
trixie	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

vim

bionic	not-affected
focal	not-affected
jammy	Fixed 2:8.2.3995-1ubuntu2.35 released
noble	Fixed 2:9.1.0016-1ubuntu7.19 released
resolute	Fixed 2:9.1.2141-1ubuntu4.8 released
trusty	not-affected
xenial	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

gvim

suse enterprise sap 12 SP5	9.2.0957-17.76.1 fixed
suse enterprise sap 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise sap 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP6	9.2.0957-150500.20.64.1 fixed
suse enterprise server 12 SP3	9.2.0957-17.76.1 fixed
suse enterprise server 12 SP5	9.2.0957-17.76.1 fixed
suse enterprise server 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise server 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP6	9.2.0957-150500.20.64.1 fixed

vim

suse enterprise desktop 15 SP7	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 12 SP5	9.2.0957-17.76.1 fixed
suse enterprise sap 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise sap 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP6	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP7	9.2.0957-150500.20.64.1 fixed
suse enterprise server 12 SP3	9.2.0957-17.76.1 fixed
suse enterprise server 12 SP5	9.2.0957-17.76.1 fixed
suse enterprise server 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise server 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP6	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP7	9.2.0957-150500.20.64.1 fixed

vim-data

suse enterprise desktop 15 SP7	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 12 SP5	9.2.0957-17.76.1 fixed
suse enterprise sap 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise sap 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP6	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP7	9.2.0957-150500.20.64.1 fixed
suse enterprise server 12 SP3	9.2.0957-17.76.1 fixed
suse enterprise server 12 SP5	9.2.0957-17.76.1 fixed
suse enterprise server 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise server 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP6	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP7	9.2.0957-150500.20.64.1 fixed

vim-data-common

suse enterprise desktop 15 SP7	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 12 SP5	9.2.0957-17.76.1 fixed
suse enterprise sap 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise sap 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP6	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP7	9.2.0957-150500.20.64.1 fixed
suse enterprise server 12 SP3	9.2.0957-17.76.1 fixed
suse enterprise server 12 SP5	9.2.0957-17.76.1 fixed
suse enterprise server 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise server 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP6	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP7	9.2.0957-150500.20.64.1 fixed

vim-small

suse enterprise desktop 15 SP7	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise sap 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP6	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP7	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise server 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP6	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP7	9.2.0957-150500.20.64.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

vim-X11

RHEL 9

2:8.2.2637-26.el9_8.21

fixed

vim-common

RHEL 9

2:8.2.2637-26.el9_8.21

fixed

vim-enhanced

RHEL 9

2:8.2.2637-26.el9_8.21

fixed

Amazon Linux Releases

Amazon Package

Release

vim-X11

Amazon Linux 2

2:9.0.2153-1.amzn2.0.10

fixed

vim-common

Amazon Linux 2	2:9.0.2153-1.amzn2.0.10 fixed
Amazon Linux 2023	2:9.2.920-1.amzn2023.0.1 fixed

vim-data

Amazon Linux 2	2:9.0.2153-1.amzn2.0.10 fixed
Amazon Linux 2023	2:9.2.920-1.amzn2023.0.1 fixed

vim-debuginfo

Amazon Linux 2	2:9.0.2153-1.amzn2.0.10 fixed
Amazon Linux 2023	2:9.2.920-1.amzn2023.0.1 fixed

vim-debugsource

Amazon Linux 2023

2:9.2.920-1.amzn2023.0.1

fixed

vim-default-editor

Amazon Linux 2023

2:9.2.920-1.amzn2023.0.1

fixed

vim-enhanced

Amazon Linux 2	2:9.0.2153-1.amzn2.0.10 fixed
Amazon Linux 2023	2:9.2.920-1.amzn2023.0.1 fixed

vim-enhanced-debuginfo

Amazon Linux 2023

2:9.2.920-1.amzn2023.0.1

fixed

vim-filesystem

Amazon Linux 2	2:9.0.2153-1.amzn2.0.10 fixed
Amazon Linux 2023	2:9.2.920-1.amzn2023.0.1 fixed

vim-minimal

Amazon Linux 2	2:9.0.2153-1.amzn2.0.10 fixed
Amazon Linux 2023	2:9.2.920-1.amzn2023.0.1 fixed

vim-minimal-debuginfo

Amazon Linux 2023

2:9.2.920-1.amzn2023.0.1

fixed

xxd

Amazon Linux 2	2:9.0.2153-1.amzn2.0.10 fixed
Amazon Linux 2023	2:9.2.920-1.amzn2023.0.1 fixed

xxd-debuginfo

Amazon Linux 2023

2:9.2.920-1.amzn2023.0.1

fixed

Azure Linux Releases

Azure Package

Release

vim

Azure Linux 3.0

0:9.2.0957-1.azl3

fixed

Common Weakness Enumeration

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Vulnerability Media Exposure

[GERMAN] vim: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in vim ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, und um nicht näher spezifizierte Auswirkungen zu verursachen.
Published: 2026-07-23T22:00:00+00:00

References

https://github.com/vim/vim/commit/c5a82fe013e73c98004ad7cd4f906b1ad1ed610e

https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2