Описание
Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in
runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479.
A flaw was found in Vim. When decompressing .tgz archives, the Vimuntar function builds shell commands using shellescape() without the {special} flag. This allows a specially crafted archive filename to trigger Vim cmdline-special expansion and execute arbitrary commands in the context of the current user.
Отчет
To exploit this issue, an attacker needs to convince a user to decompress a .tgz archive with a specially crafted filename. Additionally, possible arbitrary command execution is restricted to the context of the user running Vim. These conditions limit the exposure of this vulnerability and the potential of a full system compromise. Due to these reasons, this flaw has been rated with a moderate severity.
Меры по смягчению последствий
To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | vim | Affected | ||
| Red Hat Enterprise Linux 7 | vim | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Affected | ||
| Red Hat Enterprise Linux 10 | vim | Fixed | RHSA-2026:38509 | 13.07.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | vim | Fixed | RHSA-2026:30900 | 29.06.2026 |
| Red Hat Enterprise Linux 8 | vim | Fixed | RHSA-2026:38510 | 13.07.2026 |
| Red Hat Enterprise Linux 8 | vim | Fixed | RHSA-2026:38510 | 13.07.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | vim | Fixed | RHSA-2026:33453 | 30.06.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | vim | Fixed | RHSA-2026:33453 | 30.06.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | vim | Fixed | RHSA-2026:34477 | 01.07.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
7 High
CVSS3
Связанные уязвимости
Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479.
Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479.
Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag
Vim is an open source, command line text editor. Prior to 9.2.0479, a ...
7 High
CVSS3