Re: [LFS Trac] #4500: vim-9.1.???? (Update before release)

#4500: vim-9.1.???? (Update before release)
-------------------------+-----------------------
 Reporter:  Bruce Dubbs  |       Owner:  lfs-book
     Type:  task         |      Status:  new
 Priority:  normal       |   Milestone:  Hold
Component:  Book         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+-----------------------
Comment (by Douglas R. Reno):

 Replying to [comment:54 Joe Locash]:
 >
 > {{{
 > Vim modeline bypass via various options affects Vim < 9.2.0276
 > ==============================================================
 > Date: 31.03.2026
 > Severity: High
 > CVE: *not yet assigned*
 > CWE: Improper Neutralization of Special Elements used in an OS Command
 ('OS Command Injection') (CWE-78)
 >
 > ## Summary
 > A modeline sandbox bypass in Vim allows arbitrary OS command execution
 > when a user opens a crafted file. The `complete`, `guitabtooltip` and
 > `printheader` options are missing the `P_MLE` flag, allowing a modeline
 > to be executed. Additionally, the `mapset()` function lacks a
 > `check_secure()` call, allowing it to be abused from sandboxed
 > expressions.
 >
 > ## Description
 > The `complete` option (`src/optiondefs.h:684`) accepts `F{func}` syntax
 > to register completion callbacks (added in patch 9.1.1178), similar to
 > how `completefunc` works. However, unlike `completefunc` which has
 > `P_SECURE`, `complete` has neither `P_SECURE` nor `P_MLE`, so the
 > modeline security check at `src/option.c:1565-1571` is bypassed and
 > arbitrary lambda expressions are accepted from modelines.
 >
 > Similar effects can be achieved by setting the `guitabtooltip` and
 > `printheader` options via a modeline and abusing the `mapset()` function
 > to execute arbitrary code on random key mappings.
 >
 > ## Impact
 > An attacker who can deliver a crafted file to a victim achieves
 > arbitrary command execution with the privileges of the user running Vim.
 >
 > ## Acknowledgements
 > The Vim project would like to thank "dfwjj x" and "Avishay Matayev" for
 > identifying the vulnerability chain, providing a detailed root cause
 > analysis and reproduction steps
 >
 > ## References
 > The issue has been fixed as of Vim patch
 > [v9.2.0276](https://github.com/vim/vim/releases/tag/v9.2.0276)
 >
 > -
 [Commit](https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615f13a7)
 > - [GitHub Advisory](https://github.com/vim/vim/security/advisories/GHSA-
 8h6p-m6gr-mpw9)
 > }}}

 This issue looks similar to the above but allows for command injection in
 another way. It is unfortunately the exact same attack vector and requires
 no action other than opening an affected file.

 Bruce, can we get another new version of vim put in soon?
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/lfs/ticket/4500#comment:57>
LFS Trac <https://wiki.linuxfromscratch.org/lfs/>
Linux From Scratch: Your Distro, Your Rules.

-- 
http://lists.linuxfromscratch.org/sympa/info/lfs-book
Unsubscribe: See the above information page