CVE-2026-73073

Executive Summary

CVE-2026-73073 is a command injection vulnerability affecting Vim, the open-source command-line text editor, prior to version 9.2.0845. The flaw resides in the StructMembers() function located in runtime/autoload/ccomplete.vim, which constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value sourced from a tags file. Successful exploitation allows an attacker to inject arbitrary Ex commands and operating-system commands when a user triggers C omni-completion (CTRL-X CTRL-O) on a member access whose type resolves from a maliciously crafted tags file. Attackers who can control the contents of a tags file (e.g., via a malicious open-source project, a compromised repository, or a shared filesystem) can achieve arbitrary code execution on the victim's machine with the privileges of the Vim user. No public PoC or exploit code has been observed in the wild, and no CVSS score has been assigned; the vector provided here is an inferred environmental assessment.

Technical Analysis

The vulnerability exists in Vim's C omni-completion subsystem, specifically within the StructMembers() function defined in runtime/autoload/ccomplete.vim. This function is responsible for resolving the members of a C struct or union when a user invokes omni-completion. During this process, Vim consults a tags file — a standard index file generated by tools like ctags — to retrieve type information. The tags file format permits supplementary fields such as typeref: and typename: which describe the underlying type of a symbol.

The NVD description states that these fields are concatenated into a vimgrep command without sufficient escaping. A vimgrep command is Vim's internal grep-based search, executed as an Ex command. The core weakness is a failure to neutralize shell metacharacters and Vim Ex-command separators. Specifically:

• An attacker who can craft a malicious tags file can insert a value into the typeref: or typename: field that contains an unterminated collection expression (e.g., an unbalanced [ bracket) followed by a command separator (e.g., | or a newline). Because the value is not properly escaped, this payload is parsed as part of the constructed Ex command, terminating the intended vimgrep invocation and chaining additional Ex commands.
• Ex commands in Vim can invoke arbitrary operating-system commands via the ! prefix (e.g., :!rm -rf /tmp/foo), and can also run any other Ex command (e.g., :read, :write, :source).
• The trigger condition is highly specific: a user must invoke C omni-completion (CTRL-X CTRL-O) on a member access (e.g., my_struct. or my_struct->) where the resolved type originates from the malicious tags file. This is not a remote/network-exposed flaw in the classic sense — it requires the attacker to influence the local filesystem contents (the tags file) and the user to perform a common editing action.

The root cause is an insufficient escaping routine — the absence of proper sanitization for Vim's shellescape() or similar escaping functions on the tags file-derived value before it is interpolated into the vimgrep command string. This follows CWE-94 (Improper Control of Generation of Code — Code Injection), as the flaw allows injection of arbitrary code into a command that is subsequently executed by the Vim process.

Attack surface considerations:

• Tags file as attack vector: Malicious tags files can be distributed via source code repositories (GitHub, GitLab), tarball downloads, upstream package repositories, or even planted on shared/collaborative filesystems. A victim who downloads such a repo and opens a C file with tags already generated (or uses a project configuration that automatically generates/trusts tags files) is at risk.
• User interaction required: The user must trigger omni-completion on a member access. This is a natural, frequent action for developers using Vim as their primary editor, making the attack realistic in a development-environment context.

Exploitation Scenarios

The attack chain for CVE-2026-73073 is an attacker controlled local file (tags file) leading to code execution upon user interaction. Since no PoC is public, the chain below is inferred strictly from the vulnerability class and the NVD description details.

1) Reconnaissance / Target Identification The attacker determines a target developer or organization that uses Vim with C omni-completion enabled (a default feature in many Vim distributions when filetype plugin indent on and omnifunc are configured). The attacker needs to identify a repository or project the victim is likely to clone/build. This reconnaissance is usually off-line — the attacker selects a popular open-source C library or tool.

2) Crafting the Malicious Tags File The attacker generates a tags file (via ctags) for the C source and then modifies the typeref: or typename: field for a specific struct/typedef entry. The malicious value is constructed as:

• An unterminated collection expression (e.g., a dangling [) — this is used to break the parser context of the vimgrep command, so that the following separator and payload are interpreted as Ex commands.
• A command separator (e.g., | or \n) to close the current command and start a new one.
• The injected Ex command(s), which can be arbitrary. For example: :!touch /tmp/pwned (operating system command) or :source ~/evil.vim (load arbitrary Vimscript).

The attacker then commits this tags file into a public repository or distributes it via a package archive. Since tags files are routinely generated by developers and often committed to repos (or regenerated via bundler scripts), the malicious file may appear legitimate.

3) Triggering the Flaw The victim clones/opens the project. The tags file is either already present (tags file in the repo root) or generated via a Makefile/script that is run (e.g., make tags). The victim opens a C file and types a struct member access, e.g., my_obj. — then presses CTRL-X CTRL-O. Vim's omni-completion kicks in:

• StructMembers() is called.
• It reads the tags file to find what my_obj resolves to, specifically retrieving the typeref: or typename: field.
• The malicious value is concatenated into the vimgrep command without proper escaping.
• The crafted Ex command chain executes, running the attacker's payload with the victim's user privileges.

4) Post-Exploitation Impact

• Arbitrary command execution on the victim's machine.
• Since Vim often runs with the user's full environment, the attacker can:
  • Install backdoors, exfiltrate SSH keys, modify source code to introduce further vulnerabilities (supply-chain poisoning of the victim's own projects).
  • Modify the tags file itself or other project files to maintain persistence and spread the malicious tags file downstream (e.g., if the victim commits changes).
• The injected payload has the same privileges as the Vim process; if Vim is run via sudo or as root (uncommon but possible), impact escalates to full system compromise.

Impact Assessment

Business Impact: This is a client-side code execution flaw in a ubiquitous developer tool. Successful exploitation yields arbitrary command execution on an end user workstation. In an enterprise context, developers, DevOps engineers, and security analysts are the primary Vim users — compromising their workstations provides a foothold for lateral movement, credential theft, and intellectual property exfiltration.

Affected Systems: Any Vim installation prior to version 9.2.0845 that has C omni-completion enabled (default in many distros) and processes untrusted tags files. This includes workstations running Linux (Ubuntu, Debian, RHEL, Arch), BSD, and macOS Vim builds, as well as Windows Vim distributions. Does not affect Vim 9.2.0845 and later.

Blast Radius: Medium — interaction required, but in a high-risk environment (source code repositories shared across teams), a single malicious tags file can compromise every developer who clones the repo. The attack is stealthy as it does not require a network connection at trigger time.

CVSS Reference: No official CVSS exists. The inferred vector above — AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H — assesses this as a high impact, low complexity local attack requiring user interaction. This is an informational estimate, not the vendor's scoring.

Detection Guidance

The following rules focus on detecting the two phases of the attack: (1) placement of a malicious tags file, and (2) the execution of anomalous Ex/! commands or suspicious subprocess creation from Vim.

Sigma Rule

title: Vim Tags File Command Injection (CVE-2026-73073)
id: 9f0d8c1d-4f6e-4a49-b7d2-3e0ab3d18cd5
status: experimental
description: Detects creation of suspicious tags files or execution of Vim commands with command injection patterns indicative of CVE-2026-73073.
author: Valtersit SOC
date: 2026/02/14
logsource:
    category: process_creation
    product: linux
detection:
    selection_vim_pipe:
        Image|endswith: '/vim'
        CommandLine|contains: 'vimgrep'
        CommandLine|contains|all:
            - 'typeref'
            - '|!'
    selection_tags_modification:
        Image|endswith: '/vim'
        TargetFilename|contains: 'tags'
    condition: selection_vim_pipe or selection_tags_modification
falsepositives:
    - Legitimate use of vimgrep displaying a colon in the typeref field
    - Developers intentionally editing tags files
level: high

YARA Rule

rule Vim_Tags_File_Command_Injection {
    meta:
        description = "Detects malicious tags files containing unescaped shell metacharacters in typeref or typename fields"
        author = "Valtersit SOC"
        date = "2026-02-14"
        reference = "CVE-2026-73073"
    strings:
        $typeref_field = /typeref:\S*\[[^\]]*(\||\n|;)/ nocase
        $typename_field = /typename:\S*\[[^\]]*(\||\n|;)/ nocase
        $ex_cmd = /(:!|:source|:shell)/
    condition:
        uint32(0) == 0x0A090A09 or // file is not empty text
        all of them
}

Suricata IDS Rule

alert tcp any any -> $HOME_NET any (msg:"CVE-2026-73073 Vim Tags File Command Injection User Agent or File Download"; flow:established,to_client; content:"tags"; content:"typeref"; nocase; content:"|"; distance:0; within:200; classtype:attempted-user; sid:2026073073; rev:1;)

Note: This rule assumes the malicious tags file is delivered over HTTP/HTTPS (e.g., via git clone over HTTP). Local file transfers will not be visible at the network level; thus this rule provides minimal coverage. It is more effective to rely on EDR/process-monitoring rules.

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [process where event.action == "exec" and process.name == "vim" and
     process.args : ("*CTRL-X*", "*CTRL-O*") ] // approximating omni-completion trigger
  [process where event.action == "exec" and
     process.parent.name == "vim" and
     process.command_line : ("*sh*", "*bash*", "*cmd*", "*powershell*")]

This EQL looks for Vim spawning a shell, which should never happen during normal omni-completion.

Splunk SPL Query

index=endpoint sourcetype=ProcessRollup2
| rename CommandLine as cmd, ParentCommandLine as parent_cmd
| where (parent_cmd LIKE "%vim%" AND (cmd LIKE "%sh%" OR cmd LIKE "%bash%" OR cmd LIKE "%/bin/sh%"))
   OR (cmd LIKE "%vimgrep%" AND cmd LIKE "%typeref%" AND cmd LIKE "%|%")
| stats count by dest, user, parent_cmd, cmd

Wazuh OSSEC Rule

<group name="vim_cve_2026_73073,">
  <rule id="730730" level="12">
    <if_sid>571</if_sid>  <!-- syscheck new file created -->
    <field name="file" >\.(tags|tags\.json|tags\.txt)$</field>
    <description>Potential malicious tags file created - CVE-2026-73073 vector</description>
  </rule>
  <rule id="730731" level="12">
    <if_sid>510</if_sid> <!-- audit process exec -->
    <match>vimgrep</match>
    <regex>.*typeref.*|.*typename.*</regex>
    <description>Vim process executing command with potential injection payload</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED.

The NVD description states a fix is available in Vim 9.2.0845, yet the automated patch trackers report no patch evidence. This discrepancy suggests the advisory is recent and the fix commit may not yet be widely mirrored or tagged in the tracked sources. Immediate action is required regardless.

1) Immediate Mitigations:

• If upgrading is not immediately possible, disable C omni-completion for C files (set omnifunc= in .vimrc or for the relevant filetype) as a temporary measure.
• Configure Vim to not automatically read tags files from untrusted directories. Set tags= to a restrictive list (e.g., only ./tags and a centrally controlled path) until the patch is applied.
• Educate developers to avoid opening projects with a pre-existing tags file from untrusted repositories.
• Review and remove suspicious tags files from cloned repositories before opening any C source file.

2) Patch/Upgrade Steps:

• Upgrade to Vim 9.2.0845 or later as soon as the official release is announced/published. The NVD description confirms this version contains the fix.
• On Linux distributions, monitor for updated packages in the standard repositories (e.g., apt upgrade vim on Debian/Ubuntu). If not immediately available, build Vim from official upstream source (https://github.com/vim/vim) at the patched commit.
• Verify the installed version with vim --version after the upgrade.

3) Long-Term Hardening:

• Implement a policy requiring verification of tags files from third-party repositories before use; this can be automated with a script that scans for shell metacharacters in fields such as typeref: and typename:.
• Use a system-level allow-listing/EDR solution that flags Vim subprocess launches (rule above) — flag any process spawned by Vim other than grep/git used for tag lookup.
• Consider running Vim in a sandboxed/contained environment (e.g., Firejail, Docker wrapper) in high-risk development environments to limit blast radius in the event of exploitation.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73073 — Official NVD description of the vulnerability. (Referenced data)
2. Vim Official Repository: https://github.com/vim/vim — Upstream source; version 9.2.0845 contains the fix. No explicit commit hash provided in the data — the release version is the authoritative reference.
3. Vim Online (Official Site): https://www.vim.org — Distribution and release notes for the patched version.
4. MITRE CWE-94: https://cwe.mitre.org/data/definitions/94.html — Classification reference for the underlying weakness.
5. CISA KEV: Not listed — no known exploitation in the wild reported by CISA KEV.

Threat Actor Activity: No evidence of active exploitation or specific threat actor campaigns has been observed in the open-source threat intelligence community. The absence of a public PoC and a CISA KEV listing suggests the exploit is not currently in wide circulation. However, the low complexity of the injection (a simple unbalanced bracket plus a command separator in a tag field) and the historical precedent of similar Vim tags-file vulnerabilities (e.g., prior issues in ctags integration) make rapid weaponization likely once a PoC emerges.