CVE-2026-73077

Executive Summary

CVE-2026-73077 is an OS command injection vulnerability (CWE-78) in Vim's filetype plugins for POSIX shell (sh), Z shell (zsh), and PowerShell (ps1). Prior to Vim 9.2.0839, attacker-controlled Visual-mode text selections are forwarded to the keywordprg handlers ShKeywordPrg, ZshKeywordPrg, and GetHelp without safe shell argument separation, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim when the victim selects text and presses K. The flaw is fixed in version 9.2.0839; no public proof of concept, exploit code, or CISA KEV listing was confirmed at the time of writing, and the CVSS vector remains unassigned.

Technical Analysis

Vim's K command invokes the keywordprg option to look up the word under the cursor — or, in Visual mode, the selected text — in an external program. The affected filetype plugins override this behavior for sh, zsh, and ps1 buffers: when the user highlights text and presses K, the selection is routed to shell-specific help handlers (ShKeywordPrg, ZshKeywordPrg, GetHelp) that ultimately invoke bash, zsh, or PowerShell to display documentation for shell builtins.

The vulnerability mechanism is a failure to safely pass attacker-controlled data into a shell command line. The NVD description explicitly states that fnameescape() and PATH_ESC_CHARS — Vim's standard helpers for neutralizing filenames and path characters before handing them to external commands — do not neutralize shell metacharacters ($, ;, |, &, `, $(, etc.) before the handler assembles the external command. This means a Visual-mode selection containing shell metacharacters is concatenated into an argument string and executed by the target shell without an intermediate quoting or escaping layer that would keep the selection as a single literal argument.

Several points are notable from a code-level perspective:

• The affected code lives in the Vim runtime distribution: runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim. Because these are runtime files shipped with Vim, the vulnerability is present in any installation that loads the default filetype plugins — no user customization is required.
• The trigger is interactive: the victim must open a file recognized as shell/PowerShell script type, select text in Visual mode, and press K. This is an "insecure default behavior" flaw rather than a memory-corruption issue, so no exploitation primitive (heap layout, ROP chain, etc.) is involved.
• The injection executes with the privileges of the Vim user, not root and not elevated. However, a typical user of shell scripts in an enterprise is a developer, DevOps engineer, or system administrator whose session may hold SSH agent keys, cloud credentials, or access to CI/CD systems.
• fnameescape() and PATH_ESC_CHARS being cited in the description indicates the plugin authors attempted some form of sanitization but relied on filename-oriented escaping that was insufficient for shell command context. The exact quoting concatenation inside the handlers is not described in public sources at the time of writing; no further implementation detail is available in the NVD entry beyond the names above.

The patch, fixed in 9.2.0839, is claimed by a single source (OSV) and is not independently confirmed (patch confidence 2/4). The nature of the fix — proper shell argument quoting in the three plugins — is consistent with the described flaw class, but the exact commit diff is not yet publicly corroborated.

Exploitation Scenarios

No public PoC exists, so the attack chain below is inferred from the vulnerability class (OS command injection via a client-side editor feature) and the descriptive details in the NVD entry.

1. Reconnaissance / target identification. An attacker crafts a malicious shell script (.sh, .zsh) or PowerShell script (.ps1) that contains a legitimate-looking function definition, help comment, or string, alongside hidden shell metacharacters embedded in a word or phrase the victim is likely to highlight. Delivery vectors include email attachments, cloned Git repositories, code review requests, or any workflow where an analyst or developer opens an untrusted script with Vim.

2. Triggering the flawed code path. The victim opens the file; Vim detects the filetype and loads the corresponding filetype plugin. The victim highlights a token in Visual mode and presses K to look up help for a shell builtin — a habitual action for Vim users. The Visual-mode selection is passed to the keywordprg handler for that filetype (ShKeywordPrg, ZshKeywordPrg, or GetHelp).

3. Execution at the vulnerability-class level. Because the selection is not shell-argument-escaped, the embedded shell metacharacters are interpreted by bash, zsh, or PowerShell. A payload can, at the class level, use command substitution, statement separators, or pipeline operators to terminate the intended lookup command and execute the attacker's command in-line. The displayed selected "word" acts as camouflage, while the injected operators carry the payload; the handler then executes the assembled command line in the victim's session.

4. Post-exploitation impact. The injected command runs as the Vim user. Attackers can read and exfiltrate local files, harvest SSH agent sockets and keychain material, steal tokens from dotfiles, install persistence (cron entries, shell profile modifications), and use the host as a lateral-movement pivot into the enterprise. Because the execution is ephemeral inside an interactive session, host-based detection requires process-ancestry telemetry rather than file hashing or network signatures.

It is acceptable and appropriate to note: no public PoC or exploit code is available; the chain is inferred from the command-injection vulnerability class, not from a published weaponized example.

Impact Assessment

• Business impact: Compromise of any workstation or jump host where Vim is used to review shell/PowerShell scripts results in account takeover of the Vim user, data exfiltration, and potential lateral movement. For security teams that analyze attacker-provided scripts (a common SOC workflow), the incident-response analyst's own machine is the attack surface.
• Affected systems: All Vim builds prior to 9.2.0839 with default runtime filetype plugins enabled. This includes virtually all Linux distributions, macOS, BSD, and Windows Vim/GVim installations. NeoVim is not named in the advisory and is not confirmed affected, but similar runtime layout should be audited.
• Blast radius: Confined to the unprivileged user account, but that account frequently has access to source code, production data, cloud CLIs, and SSH credentials. The interaction requirement (one keypress) reduces the likelihood of mass, automated exploitation but makes targeted "trick the analyst into pressing K" lures viable.
• CVSS / EPSS context: CVSS is unassigned (N/A). EPSS score 0.00140 (3.9th percentile of exploited CVEs) indicates a currently low probability of exploitation in the wild; this reflects present threat activity, not the severity of the bug class. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

Detection Guidance

Detection for this class of flaw is endpoint-centric: the behavioral signature is an editor process spawning a shell with an inline command argument, plus integrity monitoring of the affected runtime plugin files. Network detection has limited value because the vulnerability is triggered locally; the Suricata rule below flags delivery of crafted script files rather than the local trigger.

Sigma Rule

title: Suspicious Shell Spawned from Vim Editor - CVE-2026-73077
status: experimental
description: Detects bash/zsh spawned as a child of Vim with an inline -c argument, consistent with keywordprg command injection via Visual-mode selections.
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/vim'
      - '/gvim'
      - '/nvim'
  selection_shell:
    Image|endswith:
      - '/bash'
      - '/zsh'
  selection_inline:
    CommandLine|contains:
      - ' -c '
      - ' -lc '
  condition: selection_parent and selection_shell and selection_inline
falsepositives:
  - Intentional shell usage from Vim plugins
  - User running :! shell commands
  - Vim terminal emulator sessions
level: medium
tags:
  - attack.t1203
  - cwe.78
  - cve.2026.73077
---
title: PowerShell Spawned from Vim on Windows - CVE-2026-73077
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\vim.exe'
      - '\gvim.exe'
  selection_pwsh:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_args:
    CommandLine|contains:
      - ' -Command '
      - ' -EncodedCommand '
  condition: selection_parent and selection_pwsh and selection_args
falsepositives:
  - Vim plugins that legitimately invoke PowerShell
level: medium
tags:
  - attack.t1203
  - cwe.78
  - cve.2026.73077

YARA Rule

rule vim_ftplugin_keywordprg_injection
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Flags Vim filetype plugins or crafted shell scripts referencing the CVE-2026-73077 keywordprg handlers with shell metacharacter usage"
        cve = "CVE-2026-73077"
        date = "2026-01-01"
    strings:
        $a = "ShKeywordPrg" ascii wide nocase
        $b = "ZshKeywordPrg" ascii wide nocase
        $c = "GetHelp" ascii wide nocase
        $d = "keywordprg" ascii wide nocase
        $e = "PATH_ESC_CHARS" ascii wide nocase
        $f = "fnameescape" ascii wide nocase
        $s1 = "bash" ascii wide nocase
        $s2 = "zsh" ascii wide nocase
        $s3 = "powershell" ascii wide nocase
        $m1 = "$" ascii
        $m2 = ";" ascii
        $m3 = "`" ascii
    condition:
        ( (2 of ($a,$b,$c)) and $d and (1 of ($s1,$s2,$s3)) )
        or ( ($e and $f and $d) and (1 of ($m1,$m2,$m3)) )
}

Suricata IDS Rule

# CVE-2026-73077 - Vim keywordprg command injection
# Note: trigger is local (Vim K keypress). This rule detects inbound
# delivery of crafted sh/zsh/ps1 files referencing the affected handler
# names combined with shell metacharacters (malicious sample delivery).
alert http any any -> $HOME_NET any (msg:"CVE-2026-73077 - Vim keywordprg injection payload script download"; flow:established,to_client; http.response_body; content:"ShKeywordPrg"; nocase; content:"GetHelp"; nocase; pcre:"/[\$\;\|\&\`]/"; within:4096; sid:73077001; rev:1; metadata:cve CVE-2026-73077, tag command-injection;)

Elastic Detection

sequence with maxspan=10s
  [ process where event.type == "start" and process.name in ("vim", "gvim", "nvim") ] by process.entity_id
  [ process where event.type == "start" and
      parent.process.name in ("vim", "gvim", "nvim") and
      process.name in ("bash", "zsh", "powershell.exe", "pwsh.exe") and
      process.command_line in ("* -c *", "* -lc *", "* -Command *", "* -EncodedCommand *")
  ] by parent.process.entity_id

Splunk SPL Query

index=endpoint (ParentImage="*vim*" OR ParentImage="*gvim*" OR ParentImage="*nvim*")
  (Image="*bash*" OR Image="*zsh*" OR Image="*powershell.exe" OR Image="*pwsh.exe")
  (CommandLine="*-c *" OR CommandLine="*-lc *" OR CommandLine="*-Command *" OR CommandLine="*-EncodedCommand *")
| stats count min(_time) as firstTime max(_time) as lastTime by host, ParentImage, Image, CommandLine, User
| where count > 0
| sort - lastTime

Filetype plugin integrity check:

index=endpoint (file_path="*/vim/runtime/ftplugin/*" OR file_name="sh.vim" OR file_name="zsh.vim" OR file_name="ps1.vim")
| stats count by host, file_path, action, user, _time

Wazuh OSSEC Rule

<group name="vim,cve-2026-73077,">
  <!-- Syscheck: unauthorized modification of Vim filetype plugins -->
  <rule id="100730" level="8">
    <if_group>syscheck</if_group>
    <field name="file">ftplugin/(sh|zsh|ps1)\.vim</field>
    <description>CVE-2026-73077: modification of Vim runtime filetype plugin (sh/zsh/ps1) - verify integrity immediately</description>
    <group>vuln,integrity,</group>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>

  <!-- Auditd: vim spawns inline shell -->
  <rule id="100731" level="10">
    <if_group>audit</if_group>
    <field name="audit.data.argv">(^| )(vim|gvim|nvim).*(bash|zsh|powershell) -(c|lc|Command|EncodedCommand) </field>
    <description>CVE-2026-73077: Vim spawned a shell with inline command arguments - potential keywordprg injection</description>
    <group>execution,command_injection,</group>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Note: rule IDs and parent groups must be adapted to the local Wazuh deployment; the auditd event source requires the audit daemon to log execve with argv data.

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED — single source, OSV, claims the fix; not independently confirmed). Treat the version claim as provisional until verified against the official Vim repository.

1. Immediate mitigations:

   • Upgrade to Vim 9.2.0839 or later. Confirm with vim --version | head -1 or :version.
   • Until patched, do not press K on text selections inside untrusted .sh, .zsh, or .ps1 files.
   • Re-map or disable K in those filetypes, e.g., :autocmd FileType sh,zsh,ps1 noremap K <Nop>.
   • Treat untrusted scripts as untrusted executables, not inert data: open them in a viewer or sandbox if the Vim runtime cannot be updated.

2. Patch/upgrade steps:

   • Package managers: apt update && apt upgrade vim, dnf update vim, or equivalent for macOS/BSD/Windows package channels.
   • Source build: clone the upstream repository, check out the tag/commit for v9.2.0839, then build and install.
   • Verification: after upgrading, confirm the runtime plugins are the patched versions and re-test that K no longer passes unfiltered selections to the shell.

3. Long-term hardening:

   • Apply MAC policies (AppArmor/SELinux) constraining Vim's ability to execute shells.
   • Deploy EDR process-ancestry rules that alert on editor → shell → network activity.
   • Audit user runtime paths (~/.vim/ftplugin, ~/.config/nvim/ftplugin) for plugin tampering; sign or hash-review runtime files.
   • Incorporate the "don't press K on untrusted content" behavior into security awareness guidance for developers and SOC staff.
   • Track Vim security advisories and re-evaluate this CVE once independent confirmation of the 9.2.0839 patch is published.

References

1. NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73077
2. OSV advisory (patch claim source, confidence 2/4): https://osv.dev/vulnerability/CVE-2026-73077
3. Vim official release / tag for the fix: https://github.com/vim/vim/releases/tag/v9.2.0839
4. CWE-78 — Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
5. MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/

No known threat-actor campaigns or exploit-in-the-wild evidence is available for CVE-2026-73077 at the time of writing. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, and EPSS places it in the low-probability percentile (0.00140; 3.9th percentile of exploited CVEs).