AZL-96767

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-96767.json

JSON Data

https://api.test.osv.dev/v1/vulns/AZL-96767

Upstream

CVE-2026-73073

Published

2026-08-18T16:18:16Z

Modified

2026-09-10T14:17:28Z

Summary

CVE-2026-73073 affecting package vim for versions less than 9.2.0976-1

Details

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-73073

Affected packages

Azure Linux:3 / vim

Package

Name: vim
Purl: pkg:rpm/azure-linux/vim

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.2.0976-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-96767.json"