Re: [LFS Trac] #5928: vim => v9.2.0480 (Security Update) (was: vim => v9.2.0450 (Security Update))

#5928: vim => v9.2.0480 (Security Update)
-------------------------+-----------------------
 Reporter:  Joe Locash   |       Owner:  lfs-book
     Type:  enhancement  |      Status:  new
 Priority:  high         |   Milestone:  13.1
Component:  Book         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+-----------------------
Changes (by Douglas R. Reno):

 * owner:  SecurityAdvisory => lfs-book
 * summary:  vim => v9.2.0450 (Security Update) => vim => v9.2.0480
     (Security Update)

Comment:

 We're going to want to update this again to account for two new VIM
 security advisories that went public today:

 {{{
 Command Injection in tar.vim affects Vim < 9.2.479
 ==================================================
 Date: 14.05.2026
 Severity: Medium
 CVE: *requested, not yet assigned*
 CWE: Improper Neutralization of Special Elements used in an OS Command
 (CWE-78) /
      Improper Neutralization of Argument Delimiters in a Command (CWE-88)

 ## Summary
 A command injection vulnerability exists in `tar#Vimuntar()` in
 `runtime/autoload/tar.vim` when decompressing `.tgz` archives on
 Unix-like systems.  The function builds `:!gunzip` and `:!gzip -d`
 commands using `shellescape(tartail)` without the `{special}` flag,
 allowing a crafted archive filename to trigger Vim cmdline-special
 expansion and execute shell commands in the user's context.

 ## Description
 In `tar#Vimuntar()` (`runtime/autoload/tar.vim`), the archive tail name
 derived from the current buffer filename is incorporated into a `:!`
 command via `shellescape()` without the second argument.  For `:!`
 commands, Vim re-expands cmdline-special characters (`%`, `#`, `!`, and
 similar) before passing the command to the shell.  As documented under
 `:help shellescape()`, the second argument must be set to a non-zero
 value (`shellescape({string}, 1)`) whenever the result is used inside
 `:!` or `:r !`.  Because the flag is omitted here, a filename containing
 both shell metacharacters and Vim special characters can break out of
 the intended single-quoted argument and inject arbitrary shell commands.

 ## Impact
 The vulnerability allows arbitrary shell command execution with the
 privileges of the user running Vim.  Exploitation requires:
 - a Unix-like system with the tar plugin enabled,
 - a crafted `.tgz` archive on disk whose filename contains both a
   single quote and Vim cmdline-special characters, and
 - the victim to open the file and invoke the non-routine `:Vimuntar`
   command.
 The severity is rated Medium because successful exploitation yields
 arbitrary command execution, but the requirement for a user-initiated
 `:Vimuntar` invocation on an attacker-supplied suspicious filename limits
 the
 practical attack surface.

 ## Acknowledgements
 The Vim project would like to thank Aisle Research for reporting and
 analyzing the issue.

 ## References
 The issue has been fixed as of Vim patch
 [v9.2.479](https://github.com/vim/vim/releases/tag/v9.2.0479).
 -
 [Commit](https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1)
 - [Github Security
 Advisory](https://github.com/vim/vim/security/advisories/GHSA-2fpv-
 9ff7-xg5w)
 }}}

 and

 {{{
 Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename
 affects Vim < 9.2.480
 ============================================================================================
 Date: 14.05.2026
 Severity: Medium
 CVE: CVE-2026-43961
 CWE: Improper Control of Generation of Code (CWE-94) /
      Improper Neutralization of Special Elements in Output Used by a
 Downstream Component (CWE-74)

 ## Summary
 A Vimscript code injection vulnerability exists in `s:NetrwMarkFile()` in
 the
 netrw plugin (`runtime/pack/dist/opt/netrw/autoload/netrw.vim`) when
 unmarking files from the global marked-file list.  A filename derived
 from the buffer's directory listing is interpolated into a string
 expression passed to `filter()`, allowing a crafted filename containing
 a double quote to break out of the quoted string literal and execute
 arbitrary Vimscript, including shell commands via `execute()` and `:!`.

 ## Description
 `s:NetrwMarkFile()` maintains two marked-file lists: a buffer-local list
 and a global list.  When a file is unmarked, both lists are updated.
 The buffer-local list uses the safe pattern:

     call filter(s:netrwmarkfilelist_{curbufnr},'v:val != a:fname')

 where `a:fname` is referenced as a variable inside the filter expression
 and resolved at evaluation time.  The global list, however, interpolated
 the filename's value directly into the expression string:

     let dname = netrw#fs#ComposePath(b:netrw_curdir, a:fname)
     ...
     call filter(s:netrwmarkfilelist, 'v:val != "'.dname.'"')

 When `filter()` receives a string argument, the string is parsed as a
 Vimscript expression.  A filename containing `"` terminates the quoted
 literal early, after which the remainder of the filename is evaluated as
 Vimscript.  Calls such as `execute("!cmd")` inside the injected fragment
 run arbitrary Ex commands with the privileges of the user running Vim.
 The filename reaches `s:NetrwMarkFile()` through the `mf` mapping, which
 calls `s:NetrwGetWord()` to read the filename from the current line of
 the netrw directory listing.  The injection only triggers on the second
 `mf` press for a given entry, because the first press takes the
 `add()` branch and only the second takes the vulnerable `filter()`
 branch.

 ## Impact
 The vulnerability allows arbitrary Vimscript execution, and by extension
 arbitrary shell command execution, with the privileges of the user
 running Vim.  Exploitation requires:
 - a Unix-like system on which a filename may contain a double quote,
 - a crafted file present in a directory the victim browses with netrw,
   and
 - the victim to invoke `mf` twice on that specific entry to mark and
   then unmark it.
 The severity is rated Medium because exploitation requires a planted
 file with an unusual name and a deliberate mark/unmark action by the
 victim on that specific entry, although the resulting primitive is full
 command execution as the victim user.

 Note: due to the nature of the issue, it seems highly unlikely that a user
 would press mf twice on such a suspicious filename.

 ## Acknowledgements
 The Vim project would like to thank Aisle Research for reporting and
 analyzing the issue.

 ## References
 The issue has been fixed as of Vim patch
 [v9.2.480](https://github.com/vim/vim/releases/tag/v9.2.0480).
 - [Commit](https://github.com/vim/vim/commit/8af0f098c3a42a28661d0295364e)
 - [Github Security
 Advisory](https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-
 x5j3)

 }}}
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/lfs/ticket/5928#comment:4>
LFS Trac <https://wiki.linuxfromscratch.org/lfs/>
Linux From Scratch: Your Distro, Your Rules.

-- 
http://lists.linuxfromscratch.org/sympa/info/lfs-book
Unsubscribe: See the above information page