Improper Neutralization of Argument Delimiters in a Command in Vim - #VU145378

Vulnerability details

The vulnerability allows a remote user to execute arbitrary ex commands.

The vulnerability exists due to improper neutralization of argument delimiters in a command in runtime/autoload/ccomplete.vim StructMembers() when processing tags file paths returned by tagfiles() during omni-completion. A remote user can supply a tags file path containing a bar character to execute arbitrary ex commands.

User interaction is required to open a C file and invoke omni-completion on a member access whose type is only known from the tags file.

Affected software

Remediation

External References

• https://github.com/vim/vim/security/advisories/GHSA-r77m-8m55-rpr6
• https://github.com/vim/vim/commit/331d5d67028505c5b6043603a57d1e8497b922b5

Related Security Bulletins

• Improper Neutralization of Argument Delimiters in a Command in Vim