Vim (Organization): news timeline & CVEs

[vim-security] Command Execution via Rmd Syntax Highlighting in Vim < 9.2.1178

Vim before 9.2.1178 can run OS commands via R Markdown syntax highlighting; no CVE yet.

Christian Brabandt reported a medium-severity command-execution flaw in Vim versions before 9.2.1178. The R Markdown syntax script in runtime/syntax/rmd.vim collects language names of code chunks from the buffer and can lead to OS command execution. The issue is tracked as CWE-78 and CWE-20. A CVE has been requested but is not yet assigned, and the report does not describe exploitation in the wild.

oss-securityupdated Oct 15, 20:43 UTC · 1d agofirst Oct 12, 22:03 UTC · 4d agoVulnerability 3 sources1· 1 read

[vim-security] Arbitrary Code Execution via Ruby Omni-Completion in Vim < 9.2.1177

Vim before 9.2.1177 allows arbitrary code execution through Ruby omni-completion; no CVE yet.

Christian Brabandt reported a medium-severity arbitrary code execution flaw in Vim versions before 9.2.1177. The Ruby omni-completion script in runtime/autoload/rubycomplete.vim derives a type from buffer content in a way that can lead to code execution. The issue is mapped to CWE-95 and CWE-94. A CVE has been requested but is not yet assigned, with no reported in-the-wild exploitation.

oss-securityupdated Oct 15, 20:43 UTC · 1d agofirst Oct 12, 22:01 UTC · 4d agoVulnerability 3 sources1

Vim

Timeline2 articles

Appears with

[vim-security] Command Execution via Rmd Syntax Highlighting in Vim < 9.2.1178

[vim-security] Arbitrary Code Execution via Ruby Omni-Completion in Vim < 9.2.1177