OS Command Injection in Vim - #VU154174

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary commands in the context of the user running Vim.

The vulnerability exists due to improper neutralization of special elements used in an OS command in runtime/syntax/rmd.vim when processing code chunk language names in R Markdown or Quarto files. A remote attacker can trick the victim into opening a crafted file containing a language name with an overlong UTF-8 encoding of NUL and backticks, bypassing filtering before the name reaches globpath() for shell expansion, to execute arbitrary commands.

Exploitation requires a Unix-like system, enabled syntax highlighting, and dynamic fenced-language detection, which is enabled by default through g:rmd_dynamic_fenced_languages.

Affected software

Remediation

External References

• https://github.com/vim/vim/security/advisories/GHSA-x2w5-pj55-7hpc
• https://github.com/vim/vim/commit/7670338d8b695c476de868dabd34d68d6de2443b

Related Security Bulletins

• OS Command Injection in Vim