CVE-2026-73077

A vulnerability in Vim's shell script plugins (sh.vim, zsh.vim, ps1.vim) allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters.

This Important vulnerability in Vim's shell plugins allows full system compromise in Red Hat environments if a user selects crafted text in Visual mode and triggers a keyword lookup. This does not affect RHEL 8 and older versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, users can disable the keywordprg option for shell script filetypes. This prevents Vim from executing external commands via the K command with potentially untrusted input. Create or edit the following files in your Vim configuration directory:

• ~/.vim/after/ftplugin/sh.vim: setlocal keywordprg=
• ~/.vim/after/ftplugin/zsh.vim: setlocal keywordprg=
• ~/.vim/after/ftplugin/ps1.vim: setlocal keywordprg=

This change takes effect the next time a shell script is opened in Vim.