Description (CNA)
Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| vim / vim | affected < 9.2.0357 |
CWE
CWE-78
References
- https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8
- https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb
- https://github.com/vim/vim/releases/tag/v9.2.0357
ADP enrichment
No English description supplied.
No references supplied.