Vim modeline bypass via various options affects Vim < 9.2.0276

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Vim 操作系统命令注入漏洞

Vim是Vim开源的一款跨平台的文本编辑器。 Vim 9.2.0276之前版本存在操作系统命令注入漏洞，该漏洞源于模型线沙箱绕过，允许在用户打开特制文件时执行任意操作系统命令。

N/A

N/A