https://seclists.org/oss-sec/2026/q4/169: [vim-security] Ex Command Execution via Cargo Quickfix Hooks in Vim < 9.2.1201
Published Oct 15, 2026
·Updated
Affected Software
1 affected component
vim Vim<9.2.1201
The user must run :make in a Rust buffer while the cargo compiler is active. The quickfix pre- and post-command hooks then change directories using the nearest Cargo.toml path.
Users who open Rust projects located in or beneath a directory with a crafted name are exposed when they invoke :make. The directory name can inject Ex commands through the unescaped :lchdir or :chdir invocation.
Vim versions earlier than 9.2.1201 are affected. The vulnerable runtime code is runtime/autoload/cargo/quickfix.vim, where the nearest Cargo.toml directory is concatenated into :lchdir! or :chdir without escaping.