Critical Security Flaw in Vim: Arbitrary Command Execution Vulnerability
Summary
RLSA-2026:75768: Important: vim security update. Affects vim versions < 2:8.2.2637-26.el9_8.23. Fixed in 2:8.2.2637-26.el9_8.23. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim, short for Vi IMproved, is a highly configurable text editor built to enable efficient text editing. It is widely used by developers and system administrators for its powerful features, including syntax highlighting, multi-level undo, and extensive plugin support. However, a recent security vulnerability has been identified that allows for arbitrary command execution through a crafted tags file during C omni-completion, posing significant risks to users.
Vulnerability Detail
The vulnerability, identified as CVE-2026-73073, arises from improper handling of crafted tags files in Vim's C omni-completion feature. This flaw can be exploited by an attacker to execute arbitrary commands on the affected system, potentially leading to unauthorized access, data loss, or system compromise. The severity of this vulnerability is underscored by its CVSS score of 7.3, indicating a high risk to users who have not applied the necessary updates.
How To Fix
Minimum fixed version
2:8.2.2637-26.el9_8.23
This is the first release that contains the fix.
sudo dnf update vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the C omni-completion feature in Vim to prevent exploitation until the package is updated. This can be done by modifying the Vim configuration file (usually located at ~/.vimrc) and adding the following line: 'set completeopt-=omni'.
Conclusion
The discovery of CVE-2026-73073 in Vim highlights the importance of keeping software up to date to mitigate security risks. Users are strongly advised to update their Vim installations to the latest patched version to protect against potential exploitation. Additionally, utilizing tools like Vulert can help maintain awareness of vulnerabilities in open-source software.
See every vulnerability recorded for vim →
FAQ
CVE-2026-73073 is a security vulnerability in Vim that allows for arbitrary command execution via crafted tags files during C omni-completion.
You can check your Vim version by running 'vim --version' in your terminal. If it is below 2:8.2.2637-26.el9_8.23, it is vulnerable.
Exploitation of this vulnerability can lead to unauthorized command execution, data loss, or complete system compromise.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring an account.
Related vulnerabilities
Recent vulnerabilities recorded for vim.
