CVE-2026-73077 vim CVE debrief

Who should care

Defenders responsible for systems and applications using Vim should assess exposure and apply patches to prevent potential arbitrary command execution. This includes verifying Vim versions and applying patches for versions prior to 9.2.0839. Additionally, defenders should review and restrict Visual-mode selections and keywordprg commands, monitor for suspicious activity, and update documentation. Affected operator, platform, vulnerability-management, and

Why it matters

CVE-2026-73077 allows attackers to execute arbitrary operating-system commands with user privileges in Vim versions prior to 9.2.0839, requiring defenders to verify exposure and apply patches.

• Potential arbitrary command execution with user privileges
• Possible unauthorized access and data breaches
• Required verification of Vim versions and exposure
• Necessity for timely patch application

Technical summary

The runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins in Vim pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839. The vulnerability allows defenders to verify exposure and apply patches to prevent potential arbitrary command execution. The CVE record and NVD entry provide details on the vulnerability.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Vim versions prior to 9.2.0839.

Recommended defensive actions

• Verify Vim version and apply patch 9.2.0839 or later
• Review and restrict Visual-mode selections and keywordprg commands
• Monitor for suspicious activity and update documentation
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Vim, which allows arbitrary operating-system commands to execute with the privileges of the user running Vim. The vulnerability is caused by the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins passing attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. The issue is fixed in version 9.2.0839. Defenders should verify exposure and apply patches. The CVE

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.