[LFS Trac] #5928: Vim => v9.2.0435 (Security Update)

#5928: Vim => v9.2.0435 (Security Update)
-------------------------+----------------------
 Reporter:  Joe Locash   |      Owner:  lfs-book
     Type:  enhancement  |     Status:  new
 Priority:  high         |  Milestone:  13.1
Component:  Book         |    Version:  git
 Severity:  normal       |   Keywords:
-------------------------+----------------------
 {{{
 OS Command Injection via 'path' completion affects Vim < 9.2.0435
 =================================================================
 Date: 02.05.2026
 Severity: Medium
 CVE: *requested, not yet assigned*
 CWE: Improper Neutralization of Special Elements used in an OS Command
 ('OS Command Injection') (CWE-78)

 ## Summary
 An OS command injection vulnerability exists in Vim's `:find`
 command-line completion.  When the `path` option contains
 backtick-enclosed shell commands, those commands are executed during
 file name completion. Because the `path` option lacks the `P_SECURE`
 flag, it can be set from a modeline, allowing an attacker who controls
 the contents of a file to execute arbitrary shell commands when the user
 opens that file in Vim and triggers `:find` completion.

 ## Description
 The `path` option is used by `:find` Ex commands to locate files.  When
 command-completion is invoked on these commands, the value of `path` is
 processed by `expand_in_path()`, which ultimately reaches
 `mch_expand_wildcards()`.  The latter constructs a shell command from
 each path entry and any matching glob characters; in the process, text
 enclosed in backticks is executed by the shell.

 The `expand_in_path()` code path has no check for backtick expansion.
 Additionally, the `path` option is missing the `P_SECURE` flag in
 `optiondefs.h`, so a modeline can set it to a value containing
 backticks.  Once the modeline has been applied, the `secure` global is
 no longer set, and the subsequent `:find` completion executes the
 backtick contents.

 ## Impact
 The vulnerability allows arbitrary shell command execution in the
 context of the Vim process when the user invokes `:find`, `:sfind`,
 `:tabfind` or related completion and the path option has been set to
 include backticks.

 Exploitation via modeline requires `'modeline'` to be enabled (the
 default in Vim <9.2.0350) and the user to trigger file completion after
 opening the file.

 The severity is rated Medium because exploitation requires opening an
 attacker-controlled file and pressing Tab during a common completion
 operation.

 Vim 9.2.0350 and later are not affected from the modeline vulnerability
 because the `'modelinestrict'` hardening prevents `'path'` from being
 set via modeline.

 ## Acknowledgements
 The Vim project would like to thank github user @q1uf3ng for reporting
 the issue.

 ## References
 The issue has been fixed as of Vim patch
 [v9.2.0435](https://github.com/vim/vim/releases/tag/v9.2.0435).
 -
 [Commit](https://github.com/vim/vim/commit/190cb3c2b9c769a3972bcfd991a7b5b6cb771ef0)
 - [Github Security
 Advisory](https://github.com/vim/vim/security/advisories/GHSA-hwg5-3cxw-
 wvvg)
 }}}
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/lfs/ticket/5928>
LFS Trac <https://wiki.linuxfromscratch.org/lfs/>
Linux From Scratch: Your Distro, Your Rules.

-- 
http://lists.linuxfromscratch.org/sympa/info/lfs-book
Unsubscribe: See the above information page