CVE-2026-73076

7.8 Élevée

Publiée le 11/08/2026 à 18:17 · Modifiée le 06/10/2026 à 21:39 · Analysée par le NVD · Source : security-advisories@github.com

Description

Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.

Traduire en français

Produits concernés

vim
Vim vim

Scores CVSS

Version	Score	Source	Vecteur
4.0	8.4 Élevée	security-advisories@github.com	`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	7.8 Élevée	nvd@nist.gov (NVD)	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

Références

https://github.com/vim/vim/commit/581a2f3ac9c6f96a26324f6b2c8c11415fd0d452 Patch
https://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2 PatchVendor Advisory

CVE-2026-73076

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs