REDHAT-BUG-2487964: Code Injection
Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vim (netrw plugin netrw.vim)to a version that resolves this vulnerability.Fixed in 9.2.0495 - Compensating control
Mitigate by preventing or sanitizing crafted directory names that could be browsed/serialized into ~/.vim/.netrwhist until Vim is upgraded to 9.2.0495.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2487964?
The severity of REDHAT-BUG-2487964 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2487964?
To fix REDHAT-BUG-2487964, upgrade Vim to version 9.2.0495 or later.
What type of vulnerability is REDHAT-BUG-2487964?
REDHAT-BUG-2487964 is a code injection vulnerability in the Vim text editor.
In which component does REDHAT-BUG-2487964 occur?
REDHAT-BUG-2487964 occurs in the netrw plugin of the Vim text editor.
What is the impact of REDHAT-BUG-2487964?
The impact of REDHAT-BUG-2487964 allows for potential code injection through improperly handled directory paths.