Three medium Vim flaws allow code or command execution without CVEs

Christian Brabandt disclosed three medium Vim flaws that can run code or commands via Ruby, R Markdown, and Cargo scripts; CVEs are not assigned.

Christian Brabandt reported three separate medium-severity flaws in Vim via oss-security. In versions before 9.2.1177, the Ruby omni-completion script runtime/autoload/rubycomplete.vim derives a type from buffer content in a way that can lead to arbitrary code execution, mapped to CWE-94 and CWE-95. In versions before 9.2.1178, the R Markdown syntax script runtime/syntax/rmd.vim collects language names of code chunks from the buffer and can lead to OS command execution, mapped to CWE-78 and CWE-20. In versions before 9.2.1201, Rust support in runtime/autoload/cargo/quickfix.vim can lead to Ex command execution, described as command injection under CWE-77 and CWE-78. All three reports say a CVE was requested but not yet assigned, and none describes exploitation in the wild. The sources do not disagree; they cover different scripts, version cutoffs, and weakness classes.

• Christian Brabandt reported three medium-severity Vim issues on oss-security; none describes in-the-wild exploitation.
• Vim before 9.2.1177: Ruby omni-completion in runtime/autoload/rubycomplete.vim can lead to arbitrary code execution (CWE-94, CWE-95), disclosed 2026-10-12.
• Vim before 9.2.1178: R Markdown syntax in runtime/syntax/rmd.vim can lead to OS command execution (CWE-78, CWE-20), disclosed 2026-10-12.
• Vim before 9.2.1201: Cargo quickfix hooks in runtime/autoload/cargo/quickfix.vim can lead to Ex command execution / command injection (CWE-77, CWE-78), disclosed 2026-10-15.
• A CVE was requested for each issue and none has been assigned.