https://seclists.org/oss-sec/2026/q4/139: [vim-security] Command Execution via Rmd Syntax Highlighting in Vim < 9.2.1178
Published Oct 12, 2026
·Updated
Affected Software
1 affected component
vim Vim<9.2.1178
Unix users of affected Vim versions who open untrusted R Markdown files are exposed when Vim processes Rmd syntax highlighting. A crafted code-chunk language name can cause text from the file to reach a shell-interpreted glob pattern.
Yes. The affected code path is used with the default g:rmd_dynamic_fenced_languages setting, which dynamically processes language names found in fenced code chunks.
The attacker needs to provide a crafted R Markdown file containing a code chunk whose language name includes a byte sequence that causes the regular-expression sanitization to stop early. Opening that file in Vim can then lead to arbitrary command execution on Unix.