Описание
Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.
A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature.
Отчет
This Moderate flaw in Vim's C omni-completion script allows for arbitrary command execution. Exploitation requires a user to open a specially crafted C source file along with a malicious project tags file and then invoke C omni-completion. This limits the attack vector as it relies on specific user interaction and the presence of a hostile tags file, making it less likely to be exploited without user awareness.
Меры по смягчению последствий
Users are advised to avoid opening untrusted C source files or project tags files in Vim. Exercising caution and only processing trusted content prevents exploitation.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | vim | Affected | ||
| Red Hat Enterprise Linux 7 | vim | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat Enterprise Linux 10 | vim | Fixed | RHSA-2026:48650 | 31.07.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | vim | Fixed | RHSA-2026:55431 | 17.08.2026 |
| Red Hat Enterprise Linux 8 | vim | Fixed | RHSA-2026:48703 | 31.07.2026 |
| Red Hat Enterprise Linux 8 | vim | Fixed | RHSA-2026:48703 | 31.07.2026 |
| Red Hat Enterprise Linux 9 | vim | Fixed | RHSA-2026:47982 | 29.07.2026 |
| Red Hat Enterprise Linux 9 | vim | Fixed | RHSA-2026:47982 | 29.07.2026 |
| Red Hat OpenShift Container Platform 4.22 | rhcos-4.22.9.8.202608130832 | Fixed | RHSA-2026:54769 | 18.08.2026 |
Показывать по
Дополнительная информация
Статус:
6.5 Medium
CVSS3
Связанные уязвимости
Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.
Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.
Vim is an open source, command line text editor. Prior to 9.2.0735, th ...
6.5 Medium
CVSS3