RCE in Vim

CVE-2026-73077

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keyword…

Vulnerability class: Command Injection (OS Command Injection)

Affected products

  • Vim — versions < 9.2.0839

Weakness classification (CWE)

References