This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-73077 →

UBUNTU-CVE-2026-73077

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vi...

Original description

The description as published by the source.

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:22.04:LTS vim

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.3995-1ubuntu2.35"}]}]

Ubuntu:24.04:LTS vim

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.0016-1ubuntu7.19"}]}]

Ubuntu:26.04:LTS vim

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.2141-1ubuntu4.8"}]}]

References

advisory ubuntu.com
report ubuntu.com
report cve.org
report github.com
report github.com