Vim EUVD-2026-25575

The vulnerability requires a malicious or compromised tags file accessible to the Vim user, and the user must actively invoke tag resolution via tag-jump commands (Ctrl-], :tag, :tjump, etc.) or navigate to a tag. The filename field in the tags file must contain backtick syntax (e.g., command or variations like $(command) if shell expansion applies). Default Vim configurations are vulnerable - no special configuration enables or disables the flaw. However, exploitation is limited to local attack vector; remote attackers cannot trigger tag resolution without first gaining local file system access or convincing a user to open a malicious tags file. Requires user interaction to invoke tag navigation.

CVSS 6.6 with local attack vector (AV:L), low complexity (AC:L), and no privilege requirement (PR:N) indicates a moderately severe vulnerability with practical exploitability. The user interaction requirement (UI:R) - opening a tags file or navigating via tag command - reduces immediate risk in automated scenarios but is realistic in typical development workflows where users interact with project-specific tags files or accept tags from version control. The integrity impact (I:H) and confidentiality/availability impact confirm command execution severity. No EPSS score, KEV status, or POC confirmation provided in input, so real-world exploitation likelihood cannot be cross-referenced against automated threat models. However, the straightforward injection mechanism (backtick syntax is standard shell metacharacter) and the requirement for only user interaction (not authentication or special privileges) suggest moderate practical exploitability if adversaries can deliver malicious tags files. Local-only attack vector limits scope compared to network-based injection but remains significant in development environments, Git repositories, or shared systems where tags files are distributed.

A developer clones a malicious Git repository containing a crafted .tags or tags file with a filename field like rm -rf /tmp/important_data. When the developer uses Ctrl-] to jump to a tag definition or runs :tag command in Vim, the tag resolver expands the backtick syntax and executes the embedded command with the developer's privileges, potentially deleting files or exfiltrating data.