Re: [LFS Trac] #4500: vim-9.1.???? (Update before release)

#4500: vim-9.1.???? (Update before release)
-------------------------+-----------------------
 Reporter:  Bruce Dubbs  |       Owner:  lfs-book
     Type:  task         |      Status:  new
 Priority:  normal       |   Milestone:  Hold
Component:  Book         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+-----------------------
Comment (by Joe Locash):

 {{{
 Vim modeline bypass via various options affects Vim < 9.2.0276
 ==============================================================
 Date: 31.03.2026
 Severity: High
 CVE: *not yet assigned*
 CWE: Improper Neutralization of Special Elements used in an OS Command
 ('OS Command Injection') (CWE-78)

 ## Summary
 A modeline sandbox bypass in Vim allows arbitrary OS command execution
 when a user opens a crafted file. The `complete`, `guitabtooltip` and
 `printheader` options are missing the `P_MLE` flag, allowing a modeline
 to be executed. Additionally, the `mapset()` function lacks a
 `check_secure()` call, allowing it to be abused from sandboxed
 expressions.

 ## Description
 The `complete` option (`src/optiondefs.h:684`) accepts `F{func}` syntax
 to register completion callbacks (added in patch 9.1.1178), similar to
 how `completefunc` works. However, unlike `completefunc` which has
 `P_SECURE`, `complete` has neither `P_SECURE` nor `P_MLE`, so the
 modeline security check at `src/option.c:1565-1571` is bypassed and
 arbitrary lambda expressions are accepted from modelines.

 Similar effects can be achieved by setting the `guitabtooltip` and
 `printheader` options via a modeline and abusing the `mapset()` function
 to execute arbitrary code on random key mappings.

 ## Impact
 An attacker who can deliver a crafted file to a victim achieves
 arbitrary command execution with the privileges of the user running Vim.

 ## Acknowledgements
 The Vim project would like to thank "dfwjj x" and "Avishay Matayev" for
 identifying the vulnerability chain, providing a detailed root cause
 analysis and reproduction steps

 ## References
 The issue has been fixed as of Vim patch
 [v9.2.0276](https://github.com/vim/vim/releases/tag/v9.2.0276)

 -
 [Commit](https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615f13a7)
 - [GitHub Advisory](https://github.com/vim/vim/security/advisories/GHSA-
 8h6p-m6gr-mpw9)
 }}}
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/lfs/ticket/4500#comment:54>
LFS Trac <https://wiki.linuxfromscratch.org/lfs/>
Linux From Scratch: Your Distro, Your Rules.

-- 
http://lists.linuxfromscratch.org/sympa/info/lfs-book
Unsubscribe: See the above information page