CVE-2026-73073: High Command Execution in Vim C Completion

CVE-2026-73073 is a code injection flaw in Vim. The C omni-completion script builds a vimgrep command using a type name from a tags file, with weak escaping, so a crafted tags file can run Ex and operating system commands. The record scores it 7.8, High. Upgrade to Vim 9.2.0845.

What's affected

The record and the advisory both say Vim before 9.2.0845 is affected and that 9.2.0845 is the fixed patch level. The flaw is in StructMembers() in runtime/autoload/ccomplete.vim.

Exploitation needs a user action. The record says the user must invoke C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from the tags file. The advisory explains that the type name is escaped only for the pattern delimiter and the backslash. A value with an unterminated collection makes Vim's own pattern skipping fail, after which the command parser looks for a command separator across the whole argument.

The weakness classes are CWE-94, improper control of generation of code, and CWE-829, inclusion of functionality from an untrusted control sphere.

How to check if you're exposed

Check the patch level of every Vim you run, including copies on servers, jump hosts and developer machines.

vim --version | head -3
vim --version | grep 'Included patches'

The second line prints a range such as 1 to a four digit number. The version is safe for this issue if that number is at least the fixed patch level. Linux distributions often backport fixes without changing the upstream patch number, so also check your distribution's security notes for the package. Vim is often installed by default on servers, in container base images and in CI images, so scan image contents too. The free in-browser scan at gold.safeguard.sh/scan can check a manifest for known CVEs.

Then think about tags files. A tags file in a repository you cloned is data that came from someone else. Developers who use C omni-completion in such a repository are the group the advisory describes.

What to do now

1. Upgrade Vim to patch level 9.2.0845 or later, or install your distribution's fixed package.
2. Until then, avoid C omni-completion with CTRL-X CTRL-O in repositories you do not trust.
3. Delete and regenerate tags files that came from outside your team, instead of reusing them.
4. Update container and CI images that include Vim.
5. Tell developers who review untrusted code that opening it in an editor can carry risk.
6. Record the patch level you now run.

Why it matters

Editors blur the line between reading a file and running one. A completion script that builds a command from file contents is code that trusts data. If the data can carry a command separator, the script runs what the data says.

The sources differ on severity. The record scores it 7.8 under CVSS 3.1 and rates it High. The Vim GitHub advisory labels it Moderate and its text says Medium. Local attack vectors and a need for user action are the reason the project rates it lower. Plan around your own use. A shared jump host where many people open files from others is a bigger risk than a single user laptop. No source reports exploitation in the wild, and the CVE is not in the CISA KEV catalog. The practical group at risk is developers who open untrusted projects, a routine part of code review and open source work.

Quick check

Sources

• Vim GitHub security advisory
• Vim release notes
• Vim fix commit

Last reviewed: 18 October 2026.