Vim (Vendor): news timeline & CVEs

[vim-security] Ex Command Execution via Cargo Quickfix Hooks in Vim < 9.2.1201

Vim before 9.2.1201 can run Ex commands through Cargo quickfix hooks, a medium command-injection flaw.

Christian Brabandt reported a medium-severity flaw in Vim before 9.2.1201. Rust support in runtime/autoload/cargo/quickfix.vim can lead to Ex command execution, described as command injection under CWE-77 and CWE-78. A CVE has been requested but is not yet assigned. The oss-security post does not report exploitation in the wild.

oss-securityOct 15, 20:43 UTC · 1d agoVulnerability 3 sources1

[vim-security] Command Execution via Rmd Syntax Highlighting in Vim < 9.2.1178

Vim before 9.2.1178 can run OS commands via R Markdown syntax highlighting; no CVE yet.

Christian Brabandt reported a medium-severity command-execution flaw in Vim versions before 9.2.1178. The R Markdown syntax script in runtime/syntax/rmd.vim collects language names of code chunks from the buffer and can lead to OS command execution. The issue is tracked as CWE-78 and CWE-20. A CVE has been requested but is not yet assigned, and the report does not describe exploitation in the wild.

oss-securityupdated Oct 15, 20:43 UTC · 1d agofirst Oct 12, 22:03 UTC · 4d agoVulnerability 3 sources1· 1 read

[vim-security] Arbitrary Code Execution via Ruby Omni-Completion in Vim < 9.2.1177

Vim before 9.2.1177 allows arbitrary code execution through Ruby omni-completion; no CVE yet.

Christian Brabandt reported a medium-severity arbitrary code execution flaw in Vim versions before 9.2.1177. The Ruby omni-completion script in runtime/autoload/rubycomplete.vim derives a type from buffer content in a way that can lead to code execution. The issue is mapped to CWE-95 and CWE-94. A CVE has been requested but is not yet assigned, with no reported in-the-wild exploitation.

oss-securityupdated Oct 15, 20:43 UTC · 1d agofirst Oct 12, 22:01 UTC · 4d agoVulnerability 3 sources1

Vim

Timeline3 articles

Appears with

[vim-security] Ex Command Execution via Cargo Quickfix Hooks in Vim < 9.2.1201

[vim-security] Command Execution via Rmd Syntax Highlighting in Vim < 9.2.1178

[vim-security] Arbitrary Code Execution via Ruby Omni-Completion in Vim < 9.2.1177