CVE-2026-73077

This is a shell injection vulnerability in Vim's K command that stems from applying the wrong escaping primitive to the wrong security boundary. The function fnameescape() exists to make file paths safe for Vim's internal path manipulation—handling spaces and Windows backslashes. Shell argument injection requires neutralizing an entirely different character class: semicolons, pipes, subshell operators, and quote characters that trigger command chaining. A developer who reaches for fnameescape() to protect shell arguments hasn't made a subtle error; they've solved the wrong problem so thoroughly that the solution looks correct from every angle except the one that matters. The K command compounds the risk because it activates in a read-oriented workflow where users have structurally lower threat perception. Selecting text and pressing K to look up help feels safe—it is information lookup, not code execution. The exploit path uses Visual mode selection to position shell metacharacters on word boundaries inside scripts the victim is already editing. The natural target population is developers debugging shell scripts, precisely the users with elevated system access and legitimate reason to highlight arbitrary text in their editor. This vulnerability belongs to a genetic family that spans decades: strcpy used where strncpy was needed, SQL concatenation where parameterized queries existed, HTML encoding applied to attribute contexts versus body contexts. The pattern is "context collision in escaping primitives"—a function named escape or sanitize gets applied across a trust boundary it was never designed to protect. The ftplugin directory that houses the vulnerable code ships bundled with Vim, receives minimal ongoing review, and loads silently for every user editing shell scripts. The code wasn't neglected—it was present and trusted precisely because it was part of the distribution. The fix in 9.2.0839 presumably introduces proper shell quoting, but the underlying genetic vulnerability persists. Shell injection through Vim's plugin layer has appeared before—CVE-2006-0314, CVE-2012-0115, CVE-2014-9140 all document metacharacter bypasses in this space. After the third or fourth instance of this exact failure mode, a project should have codified developer guidance that explicitly distinguishes file-path escaping from shell-argument escaping. Without that enforced documentation, the naming pull toward fnameescape() remains an attractor state for the next plugin author. Verify your Vim version includes the patch, audit other filetype plugins for similar misapplications of file-path escaping to shell contexts, and check whether your team's documentation makes this security domain boundary explicit—or leaves developers to infer it from function names.

Reviewed through automated stages and approved by a human before publication.