SB2026082614 - Improper Neutralization of Argument Delimiters in a Command in Vim

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: N/A)

CWE-ID: CWE-88 - Argument Injection or Modification

CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary ex commands.

The vulnerability exists due to improper neutralization of argument delimiters in a command in runtime/autoload/ccomplete.vim StructMembers() when processing tags file paths returned by tagfiles() during omni-completion. A remote user can supply a tags file path containing a bar character to execute arbitrary ex commands.

User interaction is required to open a C file and invoke omni-completion on a member access whose type is only known from the tags file.

Remediation

Install update from vendor's website.

References

• https://github.com/vim/vim/security/advisories/GHSA-r77m-8m55-rpr6
• https://github.com/vim/vim/commit/331d5d67028505c5b6043603a57d1e8497b922b5