CVE catalog

CVE-2026-73077

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual

[CVE catalog]

Severity
High · CVSS 8.6
Published
Source
[NVD] · [CVE record]
EPSS
0.14% · Oct 25, 2026

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianvimsid2:9.2.0858-1fixed
Debianvimforky2:9.2.0858-1fixed
Debianvimtrixie2:9.1.1230-2vulnerable
Debianvimbookworm2:9.0.1378-2+deb12u2vulnerable
Ubuntuvimnoble2:9.1.0016-1ubuntu7.19fixed
Ubuntuvim-athenanoble2:9.1.0016-1ubuntu7.19fixed
Ubuntuvim-commonnoble2:9.1.0016-1ubuntu7.19fixed
Ubuntuvim-docnoble2:9.1.0016-1ubuntu7.19fixed
Ubuntuvim-gtk3noble2:9.1.0016-1ubuntu7.19fixed
Ubuntuvim-gui-commonnoble2:9.1.0016-1ubuntu7.19fixed
Ubuntuvim-motifnoble2:9.1.0016-1ubuntu7.19fixed
Ubuntuvim-noxnoble2:9.1.0016-1ubuntu7.19fixed
Ubuntuvim-runtimenoble2:9.1.0016-1ubuntu7.19fixed
Ubuntuvim-tinynoble2:9.1.0016-1ubuntu7.19fixed
Ubuntuxxdnoble2:9.1.0016-1ubuntu7.19fixed
CpevimNot reported9.2.0839fixed
Ubuntuvim22.042:8.2.2434-3ubuntu3vulnerable
Ubuntuvim22.042:8.2.2434-3ubuntu4vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu1vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu2vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu3vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu5vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu1vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.1vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.3vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.4vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.5vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.7vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.8vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.9vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.10vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.11vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.12vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.13vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.15vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.16vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.17vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.18vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.19vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.20vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.21vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.22vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.23vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.24vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.26vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.27vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.28vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.29vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.30vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.31vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.32vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.33vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.34vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.35fixed
Ubuntuvim24.042:9.0.1672-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2087-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2184-0ubuntu1vulnerable
Ubuntuvim24.042:9.0.2189-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.3vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.4vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.5vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.8vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.9vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.10vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.11vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.12vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.13vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.14vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.15vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.16vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.17vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.18vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.19fixed
Ubuntuvim26.042:9.1.0967-1ubuntu6vulnerable
Ubuntuvim26.042:9.1.1882-1ubuntu1vulnerable
Ubuntuvim26.042:9.1.1882-1ubuntu2vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu1vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu2vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4.1vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4.2vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4.3vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4.5vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4.6vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4.7vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4.8fixed
Alpinevim3.239.2.0854-r0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianvimsourcesid2:9.2.0858-1not yet assignedNot reportedNot reported
Debianvimsourceforky2:9.2.0858-1not yet assignedNot reportedNot reported
Debianvimsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianvimsourcebookworm(unfixed)not yet assignedNot reportedNot reported
Ubuntuvimdebnoble2:9.1.0016-1ubuntu7.19Not reportedNot reportedNot reported
Ubuntuvim-athenadebnoble2:9.1.0016-1ubuntu7.19Not reportedNot reportedNot reported
Ubuntuvim-commondebnoble2:9.1.0016-1ubuntu7.19Not reportedNot reportedNot reported
Ubuntuvim-docdebnoble2:9.1.0016-1ubuntu7.19Not reportedNot reportedNot reported
Ubuntuvim-gtk3debnoble2:9.1.0016-1ubuntu7.19Not reportedNot reportedNot reported
Ubuntuvim-gui-commondebnoble2:9.1.0016-1ubuntu7.19Not reportedNot reportedNot reported
Ubuntuvim-motifdebnoble2:9.1.0016-1ubuntu7.19Not reportedNot reportedNot reported
Ubuntuvim-noxdebnoble2:9.1.0016-1ubuntu7.19Not reportedNot reportedNot reported
Ubuntuvim-runtimedebnoble2:9.1.0016-1ubuntu7.19Not reportedNot reportedNot reported
Ubuntuvim-tinydebnoble2:9.1.0016-1ubuntu7.19Not reportedNot reportedNot reported
Ubuntuxxddebnoble2:9.1.0016-1ubuntu7.19Not reportedNot reportedNot reported
CpevimcpeNot reported9.2.0839Not reportedNVD-CVE-2026-73077Not reported
Ubuntuvimdeb22.042:8.2.3995-1ubuntu2.35Not reportedUBUNTU-CVE-2026-73077Not reported
Ubuntuvimdeb24.042:9.1.0016-1ubuntu7.19Not reportedUBUNTU-CVE-2026-73077Not reported
Ubuntuvimdeb26.042:9.1.2141-1ubuntu4.8Not reportedUBUNTU-CVE-2026-73077Not reported
Alpinevimapk3.239.2.0854-r0Not reportedALPINE-CVE-2026-73077Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [vim]Affected
    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-athena]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-doc]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-gtk3]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-gui-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-motif]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-nox]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-runtime]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-tiny]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [xxd]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

[Debian 13 (Trixie)]

  • [vim]Affected
    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-athena]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-doc]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-gtk3]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-gui-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-motif]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-nox]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-runtime]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]