The vulnerability resides in Vim’s implementation of C omni-completion. StructMembers() creates a vimgrep command that concatenates a typeref or typename from a tags file without proper escaping. When a user triggers omni‑completion for a C member whose type originates from a tags entry, the malformed command can contain an unterminated collection and a command separator, enabling the execution of arbitrary Ex and operating‑system commands. Based on the description, it is inferred that the flaw allows an attacker who can control the tags file to run arbitrary code, potentially compromising confidentiality, integrity, and availability of the host system.

This issue affects all releases of Vim prior to 9.2.0845. The vendor is Vim, and the affected product is the Vim text editor. All builds that include the runtime/autoload/ccomplete.vim script are vulnerable until upgraded to version 9.2.0845 or later, which contains a fixed implementation that properly escapes the tags fields.

The CVSS score of 7.1 indicates high severity. No EPSS score is available, making precise exploitation probability hard to quantify. Based on the description, it is inferred that exploitation requires a local user context who can modify the tags file. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local user context; remote exploitation would need an attacker to gain local access or otherwise inject a malicious tags entry. The fix in v9.2.0845 eliminates the unsafe command construction.