SB2026101628 - Command injection in Vim

Description

This security bulletin contains information about 1 vulnerability.

1) Command injection (CVE-ID: N/A)

CWE-ID: CWE-77 - Command injection

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary Ex commands and shell commands with the privileges of the user running Vim.

The vulnerability exists due to improper neutralization of directory names in runtime/autoload/cargo/quickfix.vim when constructing :lchdir and :chdir Ex commands for cargo quickfix hooks. A remote attacker can supply a crafted directory tree containing a Cargo.toml file in a directory named x|call system('...') and induce the victim to run :make in a Rust buffer using the cargo compiler to execute injected commands through the unescaped | command separator.

Remediation

Install update from vendor's website.

References

• https://github.com/vim/vim/security/advisories/GHSA-4vf6-278g-hq7j
• https://github.com/vim/vim/commit/b93c000ddfc27c6a1192bcba77204709536cf094