vim-9.2.1178 (Security Update)

[Joe Locash]

A couple of recently announced security fixes:

Arbitrary Code Execution via Ruby Omni-Completion in Vim < 9.2.1177
===================================================================
Date: 12.10.2026
Severity: Medium
CVE: *requested, not yet assigned*
CWE: Improper Neutralization of Directives in Dynamically Evaluated Code
     (CWE-95), Improper Control of Generation of Code (CWE-94)

## Summary
The Ruby omni-completion script in `runtime/autoload/rubycomplete.vim`
derives the type of a variable from the contents of the edited buffer and
passes that text to Ruby's `eval()` without checking that it is a class name.
A crafted Ruby file can place a Ruby expression where a class name is
expected, which is evaluated when the user invokes omni-completion.

## Description
`runtime/ftplugin/ruby.vim` installs `omnifunc=rubycomplete#Complete` on every
Ruby buffer when Vim is built with the Ruby interface.  When completing after
a variable reference, `s:GetRubyVarType()` takes the variable's type from its
assignment in the buffer, and the result is passed to `eval()`.

`:help ft-ruby-omni` states that evaluating buffer code for completion must be
opted into with `g:rubycomplete_buffer_loading`.  This code path is not covered
by that setting and is reachable in the default configuration.

## Impact
Arbitrary Ruby code execution, and therefore arbitrary operating-system command
execution, in the context of the user running Vim.

Exploitation requires:

- Vim built with the Ruby interface (`+ruby` or `+ruby/dyn`),
- filetype plugins enabled
- the victim opening a crafted Ruby file and invoking omni-completion.

The severity is rated Medium because the user must open a crafted file and
invoke omni-completion. The bug does not fire on file-open alone.

## Acknowledgements
The Vim project would like to thank github user @tnshima for
reporting and analyzing the issue.

## References
The issue has been fixed as of Vim patch [v9.2.1177](https://github.com/vim/vim/releases/tag/v9.2.1177).
- [Commit](https://github.com/vim/vim/commit/05d704d2856dbb75e95bd33cf222c2e6264fff8b)
- [Github Security Advisory](https://github.com/vim/vim/security/advisories/GHSA-4xgr-vqh2-xfx8)

Command Execution via Rmd Syntax Highlighting in Vim < 9.2.1178
===============================================================
Date: 12.10.2026
Severity: Medium
CVE: *requested, not yet assigned*
CWE: Improper Neutralization of Special Elements used in an OS Command
     (CWE-78), Improper Input Validation (CWE-20)

## Summary
The R Markdown syntax script in `runtime/syntax/rmd.vim` collects the language
names of code chunks from the buffer and passes them to `globpath()`.  The
script strips non-word characters from each name with a regular expression,
which a crafted byte sequence can make stop early, so text from the file
reaches `globpath()` unfiltered.  On Unix, `globpath()` hands such a pattern to
the shell, which allows arbitrary command execution when the file is opened.

## Description
With the default `g:rmd_dynamic_fenced_languages`, `s:CheckRmdFencedLanguages()`
reads the language name of every code chunk in the buffer and calls
`s:IncludeLanguage()` for names it has not seen yet, which checks for a
matching syntax file using `globpath()`.

The name was trimmed with `substitute(v:val, '\W.*', '', '')`.  The NFA regexp
engine treats an overlong UTF-8 encoding of NUL as the end of the text, so the
pattern does not match and the rest of the name is kept.  If the name contains
backticks, `globpath()` passes it to the shell for expansion.

## Impact
Arbitrary command execution in the context of the user running Vim, when the
user opens a crafted R Markdown or Quarto file (`.rmd`, `.smd`, `.qmd` and
similar).

Exploitation requires:
- a Unix-like system (on Windows `globpath()` does not invoke the shell),
- syntax highlighting enabled
- the victim opening a crafted file.

The severity is rated Medium because the user must open a crafted file of a
specific rmd file type.

## Acknowledgements
The Vim project would like to thank github user tylerni7-ant for reporting and
analyzing the issue.

## References
The issue has been fixed as of Vim patch [v9.2.1178](https://github.com/vim/vim/releases/tag/v9.2.1178).
- [Commit](https://github.com/vim/vim/commit/7670338d8b695c476de868dabd34d68d6de2443b)
- [Github Security Advisory](https://github.com/vim/vim/security/advisories/GHSA-x2w5-pj55-7hpc)