Argument injection in Vim - #VU149473

Vulnerability details

The vulnerability allows a local user to execute arbitrary operating system commands.

The vulnerability exists due to improper neutralization of argument delimiters in a command in sign_jump() in src/sign.c when jumping to a sign in an undisplayed buffer with a crafted file name. A local user can invoke :sign jump or sign_jump() on a buffer name containing an Ex command separator to execute arbitrary operating system commands.

Vim must be built with the +signs feature.

Affected software

Remediation

External References

• https://github.com/vim/vim/security/advisories/GHSA-x9jf-rjm6-vxqh
• https://github.com/vim/vim/commit/2942c934ec7c68791b9da7ab6c29ae4987f7a2fb

Related Security Bulletins

• Argument injection in Vim