Summary
Vim contains a command injection vulnerability in C-language omni-completion when type information is read from a crafted tags file. If a user invokes completion on a member access whose type is resolved from that file, insufficient escaping may allow arbitrary Ex and operating-system commands to run.
Vim contains a command injection vulnerability in C-language omni-completion when type information is read from a crafted tags file. If a user invokes completion on a member access whose type is resolved from that file, insufficient escaping may allow arbitrary Ex and operating-system commands to run.
Affected context
The issue occurs in Vim's C omni-completion support, specifically when StructMembers() processes typeref: or typename: values from a tags file and constructs a vimgrep command. Risk depends on the user opening or using a tags file containing attacker-controlled type metadata and invoking completion on a matching member access.
The issue occurs in Vim's C omni-completion support, specifically when StructMembers() processes typeref: or typename: values from a tags file and constructs a vimgrep command. Risk depends on the user opening or using a tags file containing attacker-controlled type metadata and invoking completion on a matching member access.
Exploit preconditions
- Attack surface: Vim's C-language omni-completion functionality
- Required access: Ability to place, modify, or cause Vim to consume a crafted tags file
- Trigger point: User invocation of C omni-completion with
CTRL-X CTRL-Oon a relevant member access - Why exploitation is possible: Type information is insufficiently escaped before being incorporated into an executed Ex command, allowing command syntax to alter the intended operation
- Attack surface: Vim's C-language omni-completion functionality
- Required access: Ability to place, modify, or cause Vim to consume a crafted tags file
- Trigger point: User invocation of C omni-completion with
CTRL-X CTRL-Oon a relevant member access - Why exploitation is possible: Type information is insufficiently escaped before being incorporated into an executed Ex command, allowing command syntax to alter the intended operation
Why this happens
The underlying defect is command construction from insufficiently escaped data originating in a tags file. StructMembers() treats typeref: or typename: content as part of a vimgrep command rather than as strictly constrained data, allowing command syntax to cross the intended boundary between input and executable Ex language. This maps primarily to CWE-94: Improper Control of Generation of Code, with a related CWE-829 concern because functionality loads and executes behavior influenced by externally supplied content.
The underlying defect is command construction from insufficiently escaped data originating in a tags file. StructMembers() treats typeref: or typename: content as part of a vimgrep command rather than as strictly constrained data, allowing command syntax to cross the intended boundary between input and executable Ex language. This maps primarily to CWE-94: Improper Control of Generation of Code, with a related CWE-829 concern because functionality loads and executes behavior influenced by externally supplied content.
Potential impact
- An attacker may execute arbitrary Ex commands in the victim's Vim session.
- An attacker could execute operating-system commands with the user's privileges.
- User files, source code, or editor configuration may be altered or disclosed.
- A compromised editing environment could facilitate further local compromise.
- An attacker may execute arbitrary Ex commands in the victim's Vim session.
- An attacker could execute operating-system commands with the user's privileges.
- User files, source code, or editor configuration may be altered or disclosed.
- A compromised editing environment could facilitate further local compromise.
General mitigation guidance
Mitigation generally focuses on separating tags-file data from executable Ex command syntax and reducing trust in externally supplied metadata.
Common defensive patterns include:
- Use structured APIs or fixed command arguments instead of concatenating untrusted values into Ex commands.
- Apply context-appropriate escaping and strict allowlist validation for type and symbol fields.
- Treat tags files from untrusted repositories or directories as untrusted input.
- Prefer secure-by-default completion behavior that does not evaluate metadata as command language.
- Run the editor with least privilege and avoid using elevated accounts for routine editing.
- Limit the impact of editor command execution through operating-system permissions and sandboxing where practical.
Mitigation generally focuses on separating tags-file data from executable Ex command syntax and reducing trust in externally supplied metadata.
Common defensive patterns include:
- Use structured APIs or fixed command arguments instead of concatenating untrusted values into Ex commands.
- Apply context-appropriate escaping and strict allowlist validation for type and symbol fields.
- Treat tags files from untrusted repositories or directories as untrusted input.
- Prefer secure-by-default completion behavior that does not evaluate metadata as command language.
- Run the editor with least privilege and avoid using elevated accounts for routine editing.
- Limit the impact of editor command execution through operating-system permissions and sandboxing where practical.
How teams detect issues like this
Organizations can identify similar issues through:
- Static analysis rules for string concatenation or interpolation into Ex, shell, search, or evaluation commands.
- Code review checks for parser or completion code that passes tags-file fields into command interpreters.
- Tests using malformed, delimiter-containing, and boundary-case metadata to verify that input remains data.
- Repository policies requiring explicit trust boundaries for editor configuration and generated tags files.
- Automated security review tools that flag command construction from externally controlled values.
Organizations can identify similar issues through:
- Static analysis rules for string concatenation or interpolation into Ex, shell, search, or evaluation commands.
- Code review checks for parser or completion code that passes tags-file fields into command interpreters.
- Tests using malformed, delimiter-containing, and boundary-case metadata to verify that input remains data.
- Repository policies requiring explicit trust boundaries for editor configuration and generated tags files.
- Automated security review tools that flag command construction from externally controlled values.
