Command injection in Vim - #VU156083

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary Ex commands and shell commands with the privileges of the user running Vim.

The vulnerability exists due to improper neutralization of directory names in runtime/autoload/cargo/quickfix.vim when constructing :lchdir and :chdir Ex commands for cargo quickfix hooks. A remote attacker can supply a crafted directory tree containing a Cargo.toml file in a directory named x|call system('...') and induce the victim to run :make in a Rust buffer using the cargo compiler to execute injected commands through the unescaped | command separator.

Affected software

Remediation

External References

• https://github.com/vim/vim/security/advisories/GHSA-4vf6-278g-hq7j
• https://github.com/vim/vim/commit/b93c000ddfc27c6a1192bcba77204709536cf094

Related Security Bulletins

• Command injection in Vim