[vim-security] Ex Command Execution via Cargo Quickfix Hooks in Vim < 9.2.1201
Vim before 9.2.1201 can run Ex commands through Cargo quickfix hooks, a medium command-injection flaw.
Christian Brabandt reported a medium-severity flaw in Vim before 9.2.1201. Rust support in runtime/autoload/cargo/quickfix.vim can lead to Ex command execution, described as command injection under CWE-77 and CWE-78. A CVE has been requested but is not yet assigned. The oss-security post does not report exploitation in the wild.
- Affects Vim releases earlier than 9.2.1201.
- Flaw is in Cargo quickfix hook handling for Rust.
- Rated medium; mapped to CWE-77 and CWE-78.
- A CVE was requested and is not yet assigned.
Posted by Christian Brabandt on Oct 15 Ex Command Execution via Cargo Quickfix Hooks in Vim < 9.2.1201 =============================================================== Date: 15.10.2026 Severity: Medium CVE: *requested, not yet assigned* CWE: Improper Neutralization of Special Elements used in a Command (CWE-77), Improper Neutralization of Special Elements used in an OS Command (CWE-78) ## Summary The Rust support in `runtime/autoload/cargo/quickfix.vim` changes to the directory of...
This source does not provide full text. Read it at seclists.org.