SB2026101302 - OS Command Injection in Vim

Description

This security bulletin contains information about 1 vulnerability.

1) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary commands in the context of the user running Vim.

The vulnerability exists due to improper neutralization of special elements used in an OS command in runtime/syntax/rmd.vim when processing code chunk language names in R Markdown or Quarto files. A remote attacker can trick the victim into opening a crafted file containing a language name with an overlong UTF-8 encoding of NUL and backticks, bypassing filtering before the name reaches globpath() for shell expansion, to execute arbitrary commands.

Exploitation requires a Unix-like system, enabled syntax highlighting, and dynamic fenced-language detection, which is enabled by default through g:rmd_dynamic_fenced_languages.

Remediation

Install update from vendor's website.

References

• https://github.com/vim/vim/security/advisories/GHSA-x2w5-pj55-7hpc
• https://github.com/vim/vim/commit/7670338d8b695c476de868dabd34d68d6de2443b