https://seclists.org/oss-sec/2026/q4/169: [vim-security] Ex Command Execution via Cargo Quickfix Hooks in Vim < 9.2.1201

Q: What user interaction is required for exploitation?

The user must run :make in a Rust buffer while the cargo compiler is active. The quickfix pre- and post-command hooks then change directories using the nearest Cargo.toml path.

Q: Who is exposed to a crafted project path?

Users who open Rust projects located in or beneath a directory with a crafted name are exposed when they invoke :make. The directory name can inject Ex commands through the unescaped :lchdir or :chdir invocation.

Q: How can I determine whether my Vim installation is affected?

Vim versions earlier than 9.2.1201 are affected. The vulnerable runtime code is runtime/autoload/cargo/quickfix.vim, where the nearest Cargo.toml directory is concatenated into :lchdir! or :chdir without escaping.

Published Oct 15, 2026

Updated

Affected Software

1 affected component

vim Vim<9.2.1201

Frequently Asked Questions

What user interaction is required for exploitation?

The user must run :make in a Rust buffer while the cargo compiler is active. The quickfix pre- and post-command hooks then change directories using the nearest Cargo.toml path.

Who is exposed to a crafted project path?

Users who open Rust projects located in or beneath a directory with a crafted name are exposed when they invoke :make. The directory name can inject Ex commands through the unescaped :lchdir or :chdir invocation.

How can I determine whether my Vim installation is affected?

Vim versions earlier than 9.2.1201 are affected. The vulnerable runtime code is runtime/autoload/cargo/quickfix.vim, where the nearest Cargo.toml directory is concatenated into :lchdir! or :chdir without escaping.