SB2026072422 - OS Command Injection in Vim

Description

This security bulletin contains information about 1 vulnerability.

1) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to command injection in the shell filetype plugins when processing a crafted Visual mode selection through keyword lookup with K. A remote attacker can trick the victim into opening a crafted file, selecting a crafted line, and invoking keyword lookup to execute arbitrary code.

User interaction is required to select the crafted text in Visual mode and invoke K, and the issue affects buffers whose filetype resolves to sh, bash, zsh, or PowerShell with filetype plugins enabled.

Remediation

Install update from vendor's website.

References

• https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2
• https://github.com/vim/vim/commit/c5a82fe013e73c98004ad7cd4f906b1ad1ed610e