Executive brief
Vim is a widely used open-source text editor for programmers. A vulnerability in its C code completion feature allows a specially crafted project file (a 'tags' file) to execute malicious commands on the user's computer. This could occur if a developer opens a third-party code repository and attempts to use the auto-complete function, potentially leading to full system compromise or data theft.
Technical details
A code injection vulnerability exists in Vim's C omni-completion script (runtime/autoload/ccomplete.vim). The script interpolates 'typeref:' or 'typename:' extension fields from a tags entry directly into a :vimgrep pattern executed via :execute without proper escaping. Because :vimgrep treats the pipe character (|) as a command separator, an attacker can craft a tags file where these fields terminate the search pattern and append arbitrary Ex commands. Exploitation occurs when a user opens a C file in a directory with a malicious tags file and triggers omni-completion (CTRL-X CTRL-O) on a struct or union member. This results in arbitrary code execution with the privileges of the user running Vim.
Affected products
- Vim Vim < 9.2.0735
Timeline
- 2026-06-26: advisory: GitHub Security Advisory published
- 2026-07-09: disclosed: CVE published to NVD
- 2026-07-09: patched: Fixed in patch 9.2.0735