CVE-2026-73073

7.8 Élevée

Publiée le 18/08/2026 à 18:18 · Modifiée le 15/10/2026 à 22:32 · Analysée par le NVD · Source : security-advisories@github.com

Description

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.

Traduire en français

Produits concernés

vim
Vim vim

Scores CVSS

Version	Score	Source	Vecteur
4.0	7.1 Élevée	security-advisories@github.com	`CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	7.8 Élevée	nvd@nist.gov (NVD)	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

Références

https://github.com/vim/vim/commit/2f628d8104958fa7421664f792ca6d4f7a39a10f Patch
https://github.com/vim/vim/releases/tag/v9.2.0845 Product
https://github.com/vim/vim/security/advisories/GHSA-cx73-phcg-3j5g PatchVendor Advisory

CVE-2026-73073

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs