https://seclists.org/oss-sec/2026/q4/139: [vim-security] Command Execution via Rmd Syntax Highlighting in Vim < 9.2.1178

Q: Who is realistically exposed to this issue?

Unix users of affected Vim versions who open untrusted R Markdown files are exposed when Vim processes Rmd syntax highlighting. A crafted code-chunk language name can cause text from the file to reach a shell-interpreted glob pattern.

Q: Is the vulnerable behavior enabled by default?

Yes. The affected code path is used with the default g:rmd_dynamic_fenced_languages setting, which dynamically processes language names found in fenced code chunks.

Q: What does an attacker need to do to trigger it?

The attacker needs to provide a crafted R Markdown file containing a code chunk whose language name includes a byte sequence that causes the regular-expression sanitization to stop early. Opening that file in Vim can then lead to arbitrary command execution on Unix.

Published Oct 12, 2026

Updated

Affected Software

1 affected component

vim Vim<9.2.1178

Frequently Asked Questions

Who is realistically exposed to this issue?

Unix users of affected Vim versions who open untrusted R Markdown files are exposed when Vim processes Rmd syntax highlighting. A crafted code-chunk language name can cause text from the file to reach a shell-interpreted glob pattern.

Is the vulnerable behavior enabled by default?

Yes. The affected code path is used with the default g:rmd_dynamic_fenced_languages setting, which dynamically processes language names found in fenced code chunks.

What does an attacker need to do to trigger it?

The attacker needs to provide a crafted R Markdown file containing a code chunk whose language name includes a byte sequence that causes the regular-expression sanitization to stop early. Opening that file in Vim can then lead to arbitrary command execution on Unix.