patch 9.2.0480: [security]: runtime(netrw): code injection via mf command
Commit:
https://github.com/vim/vim/commit/8af0f098c3a42a28661d0295364e6e0fd7dbc92c
Author: Christian Brabandt <[email protected]>
Date: Thu May 14 16:43:15 2026 +0000
patch 9.2.0480: [security]: runtime(netrw): code injection via mf command
Problem: [security]: runtime(netrw): code injection via mf command
(Christopher Lusk, Zdenek Dohnal)
Solution: Do not use string concatenation inside the filter() commands
(Zdenek Dohnal)
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3
Signed-off-by: Christian Brabandt <[email protected]>
diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim
b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
index fbd396566..8681091f0 100644
--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
@@ -1,7 +1,7 @@
" Creator: Charles E Campbell
" Previous Maintainer: Luca Saccarola <[email protected]>
" Maintainer: This runtime file is looking for a new maintainer.
-" Last Change: 2026 May 11
+" Last Change: 2026 May 14
" Copyright: Copyright (C) 2016 Charles E. Campbell {{{1
" Permission is hereby granted to use and distribute this code,
" with or without modifications, provided that this copyright
@@ -5153,7 +5153,7 @@ function s:NetrwMarkFile(islocal,fname)
else
" remove filename from buffer's markfilelist
- call filter(s:netrwmarkfilelist_{curbufnr},'v:val != a:fname')
+ call filter(s:netrwmarkfilelist_{curbufnr}, {_, v -> v !=#
a:fname})
if s:netrwmarkfilelist_{curbufnr} == []
" local markfilelist is empty; remove it entirely
call s:NetrwUnmarkList(curbufnr,curdir)
@@ -5174,7 +5174,6 @@ function s:NetrwMarkFile(islocal,fname)
else
" initialize new markfilelist
-
let s:netrwmarkfilelist_{curbufnr}= []
call
add(s:netrwmarkfilelist_{curbufnr},substitute(a:fname,'[|@]$','',''))
@@ -5194,7 +5193,7 @@ function s:NetrwMarkFile(islocal,fname)
call
add(s:netrwmarkfilelist,netrw#fs#ComposePath(b:netrw_curdir,a:fname))
else
" remove new filename from global markfilelist
- call filter(s:netrwmarkfilelist,'v:val != "'.dname.'"')
+ call filter(s:netrwmarkfilelist, {_, v -> v !=# dname})
if s:netrwmarkfilelist == []
unlet s:netrwmarkfilelist
endif
@@ -7217,7 +7216,7 @@ function s:NetrwTreeDisplay(dir,depth)
" hide given patterns
let listhide= split(g:netrw_list_hide,',')
for pat in listhide
- call filter(w:netrw_treedict[dir],'v:val !~ "'.escape(pat,'\').'"')
+ call filter(w:netrw_treedict[dir], {_, v -> v !~# pat})
endfor
elseif g:netrw_hide == 2
diff --git a/src/testdir/test_plugin_netrw.vim
b/src/testdir/test_plugin_netrw.vim
index c6bd589a4..72bf8300e 100644
--- a/src/testdir/test_plugin_netrw.vim
+++ b/src/testdir/test_plugin_netrw.vim
@@ -725,4 +725,19 @@ func Test_netrw_bookmark_marked_file()
bw!
endfunc
+func Test_netrw_mf_command_injection()
+ CheckUnix
+ CheckExecutable touch
+ let path = tempname()
+ let fname = 'x" . execute("silent! !touch poc") . "'
+ call mkdir(path, 'R')
+ exe "cd " path
+ call writefile([], fname)
+ Explore .
+ call search('^x')
+ :norm mf
+ :norm mf
+ call assert_false(filereadable('poc'), 'Command injection via mf command')
+endfunc
+
" vim:ts=8 sts=2 sw=2 et
diff --git a/src/version.c b/src/version.c
index c98028a80..df580d3de 100644
--- a/src/version.c
+++ b/src/version.c
@@ -729,6 +729,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 480,
/**/
479,
/**/
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/d/msgid/vim_dev/E1wNZPn-004pt2-UN%40256bit.org.
