Re: [LFS Trac] #4500: vim-9.1.???? (Update before release)

#4500: vim-9.1.???? (Update before release)
-------------------------+-----------------------
 Reporter:  Bruce Dubbs  |       Owner:  lfs-book
     Type:  task         |      Status:  new
 Priority:  normal       |   Milestone:  Hold
Component:  Book         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+-----------------------
Comment (by Joe Locash):

 {{{
 Vim tabpanel modeline escape affects Vim < 9.2.0272
 ===================================================
 Date: 30.03.2026
 Severity: High
 CVE: *not yet assigned*
 CWE: Improper Neutralization of Special Elements used in an OS Command
 (CWE-78)

 ## Summary
 A bug chain in Vim allows arbitrary OS command execution when a user
 opens a crafted file. The `tabpanel` option is missing the `P_MLE` flag,
 allowing a modeline to inject a `%{expr}` expression string without
 requiring `modelineexpr` to be enabled. Although Vim correctly evaluates
 the expression inside the sandbox, `autocmd_add()` lacks a
 `check_secure()` call, allowing sandboxed code to register an
 autocommand that fires after the sandbox exits.

 ## Description
 The `tabpanel` option (`src/optiondefs.h:2581`) accepts `%{expr}` format
 strings identically to `statusline` and `tabline`, both of which carry
 the `P_MLE` flag to require `modelineexpr` for modeline use. `tabpanel`
 is missing this flag, so the modeline security check at
 `src/option.c:1572-1576` is never reached and arbitrary expression
 strings are accepted from modelines.

 Vim correctly detects that the option was set insecurely and evaluates
 the expression inside the sandbox (`src/eval.c:747-758`). However,
 `autocmd_add()` (`src/autocmd.c:3316`) contains no `check_secure()`
 call. While the `:autocmd` ex command is properly blocked in the sandbox
 (no `EX_SBOXOK`), but the function interface bypasses this restriction.

 ## Impact
 An attacker who can deliver a crafted file to a victim achieves
 arbitrary command execution with the privileges of the user running Vim.
 The attack requires only that the victim opens the file; no further
 interaction is needed. `modeline` is enabled by default and
 `modelineexpr` does not need to be enabled. Vim builds with `+tabpanel`
 (FEAT_HUGE, the default) are affected.

 ## Acknowledgements
 The Vim project would like to thank Koda Reef for identifying the
 vulnerability chain, providing a detailed root cause analysis,
 reproduction steps, and
 suggested fixes.

 ## References
 The issue has been fixed as of Vim patch
 [v9.2.0272](https://github.com/vim/vim/releases/tag/v9.2.0272)

 -
 [Commit](https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d600815ec1f43459)
 - [GitHub Advisory](https://github.com/vim/vim/security/advisories/GHSA-
 2gmj-rpqf-pxvh)
 }}}
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/lfs/ticket/4500#comment:53>
LFS Trac <https://wiki.linuxfromscratch.org/lfs/>
Linux From Scratch: Your Distro, Your Rules.

-- 
http://lists.linuxfromscratch.org/sympa/info/lfs-book
Unsubscribe: See the above information page