Executive Summary

This vulnerability exists in the Vim text editor prior to version 9.2.0435. It is an OS command injection issue related to Vim's :find command-line completion feature.

When the 'path' option in Vim contains backtick-enclosed shell commands, those commands get executed during file name completion. Because the 'path' option lacks the P_SECURE flag, it can be set from a modeline within a file.

An attacker who controls the contents of a file can insert such a modeline, causing arbitrary shell commands to be executed when a user opens that file in Vim and triggers :find completion.

This vulnerability has been fixed in Vim version 9.2.0435.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute arbitrary shell commands on your system when you open a maliciously crafted file in Vim and use the :find command-line completion.

Such command execution can lead to unauthorized actions, including data theft, system compromise, or further malware installation, depending on the commands executed.

Because the attack requires user interaction (opening the file and triggering :find completion), the risk depends on the likelihood of opening attacker-controlled files.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update Vim to version 9.2.0435 or later, where the issue has been patched.

Avoid opening untrusted files in Vim that could contain malicious modelines setting the path option with backtick-enclosed shell commands.

Useful 0 Not Useful 0