CVE-2026-73077 is a command injection flaw in Vim's shell filetype plugins. A crafted line in a script can run operating system commands when a user selects it in Visual mode and presses K, because the selection is not safely separated. The record scores it 7.8, High. Upgrade to Vim 9.2.0839.
What's affected
The record and the advisory both say Vim before 9.2.0839 is affected and that 9.2.0839 is the fixed patch level. The affected files are the filetype plugins runtime/ftplugin/sh.vim, zsh.vim and ps1.vim, which cover bash, zsh and PowerShell buffers.
The advisory explains that these plugins install a buffer local keywordprg that places its argument into a bash, zsh or PowerShell command. A keywordprg that begins with a colon is escaped with fnameescape(), which does not neutralize shell metacharacters. K in Visual mode passes the whole selection as it is. A crafted line in a script can therefore run commands when a user selects it and presses K.
The weakness class is CWE-78, improper neutralization of special elements used in an OS command.
How to check if you're exposed
Check the patch level of every Vim you run, including copies on servers, jump hosts and developer machines.
vim --version | head -3
vim --version | grep 'Included patches'
The second line prints a range such as 1 to a four digit number. The version is safe for this issue if that number is at least the fixed patch level. Linux distributions often backport fixes without changing the upstream patch number, so also check your distribution's security notes for the package. Vim is often installed by default on servers, in container base images and in CI images, so scan image contents too. The free in-browser scan at gold.safeguard.sh/scan can check a manifest for known CVEs.
The exposure is tied to habit. If your people use K on a selection to look up help for shell, zsh or PowerShell code, and they open scripts from other people, they match the scenario.
What to do now
- Upgrade Vim to patch level 9.2.0839 or later, or install your distribution's fixed package.
- Until then, avoid pressing K on a Visual selection in shell, zsh or PowerShell files from untrusted sources.
- Read scripts from outside sources in a pager or a safe viewer before editing them.
- Update container and CI images that include Vim.
- Share the guidance with developers and operations staff who edit scripts from others.
- Record the patch level you now run.
Why it matters
The key behind K is meant to look something up. When the lookup is run through a shell, the selected text is part of a command line, and shell metacharacters in it have meaning. Escaping for file names is not the same as escaping for a shell, and the gap between them is where the command runs.
The sources differ on severity. The record scores it 7.8 under CVSS 3.1 and rates it High. The Vim GitHub advisory labels it Moderate and its text says Medium. Local attack vectors and a need for user action are the reason the project rates it lower. Plan around your own use. A shared jump host where many people open files from others is a bigger risk than a single user laptop. No source reports exploitation in the wild, and the CVE is not in the CISA KEV catalog. The attack is local and needs a deliberate keystroke, but reviewing a script is exactly what people do before running one, so the editor step should be safe too.
Quick check
What must a user do for the bug to trigger?
Select a crafted line in Visual mode in a bash, zsh or PowerShell buffer and press K.
Which patch level fixes it?
Vim 9.2.0839.
Sources
Last reviewed: 18 October 2026.
