Control: tags -1 - moreinfo
On Fri, Sep 04, 2026 at 12:18:28PM +0100, Adam D. Barratt wrote:
On Wed, 2026-08-12 at 09:06 -0400, James McCoy wrote:
Neovim versions >= 0.9 added a vim.secure module to manage trust when
automatically sourcing files from a directory. The vim.secure.read()
API, used to read those files, was subject to command injection
(CVE-2026-11487).
The debdiff appears to be missing.
Attached this time. :)
Cheers,
--
James (he/him)
GPG Key: 4096R/91BF BF4D 6956 BD5D F7B7 2D23 DFE6 91AE 331B A3DB
diffstat for neovim-0.10.4 neovim-0.10.4
changelog | 11 +
gbp.conf | 2
patches/0005-fix-vim.secure-read-command-injection-vulnerability-.patch | 69 ++++++++++
patches/series | 1
salsa-ci.yml | 1
5 files changed, 83 insertions(+), 1 deletion(-)
diff -Nru neovim-0.10.4/debian/changelog neovim-0.10.4/debian/changelog
--- neovim-0.10.4/debian/changelog 2025-03-17 22:34:18.000000000 -0400
+++ neovim-0.10.4/debian/changelog 2026-08-12 06:54:33.000000000 -0400
@@ -1,3 +1,14 @@
+neovim (0.10.4-8+deb13u1) trixie; urgency=medium
+
+ [ Agathe Porte ]
+ * d/gbp.conf: update for debian/trixie branch
+ * Backport upstream fix for CVE-2026-11487
+
+ [ James McCoy ]
+ * ci: Set release to trixie
+
+ -- James McCoy <[email protected]> Wed, 12 Aug 2026 06:54:33 -0400
+
neovim (0.10.4-8) unstable; urgency=medium
* Require python3-pynvim 0.5.2-2 to ensure it has correct Depends
diff -Nru neovim-0.10.4/debian/gbp.conf neovim-0.10.4/debian/gbp.conf
--- neovim-0.10.4/debian/gbp.conf 2025-03-17 22:34:18.000000000 -0400
+++ neovim-0.10.4/debian/gbp.conf 2026-08-12 06:54:33.000000000 -0400
@@ -1,4 +1,4 @@
[DEFAULT]
-debian-branch = debian/sid
+debian-branch = debian/trixie
debian-tag = v%(version)s
upstream-tag = v%(version)s
diff -Nru neovim-0.10.4/debian/patches/0005-fix-vim.secure-read-command-injection-vulnerability-.patch neovim-0.10.4/debian/patches/0005-fix-vim.secure-read-command-injection-vulnerability-.patch
--- neovim-0.10.4/debian/patches/0005-fix-vim.secure-read-command-injection-vulnerability-.patch 1969-12-31 19:00:00.000000000 -0500
+++ neovim-0.10.4/debian/patches/0005-fix-vim.secure-read-command-injection-vulnerability-.patch 2026-08-12 06:54:33.000000000 -0400
@@ -0,0 +1,69 @@
+From: "Justin M. Keyes" <[email protected]>
+Date: Wed, 20 May 2026 15:27:43 -0400
+Subject: fix(vim.secure): read() command injection vulnerability #39918
+
+Problem:
+Malicious filename can execute code because of ":" cmdline expansion.
+
+Solution:
+Use `fnameescape()`.
+
+fix https://github.com/neovim/neovim/issues/39914
+
+(cherry picked from commit 799cbfff855c72282a54646f3e5e1b71b0da223c)
+---
+ runtime/lua/vim/secure.lua | 2 +-
+ test/functional/lua/secure_spec.lua | 28 ++++++++++++++++++++++++++++
+ 2 files changed, 29 insertions(+), 1 deletion(-)
+
+diff --git a/runtime/lua/vim/secure.lua b/runtime/lua/vim/secure.lua
+index 41a3d3b..2a35b38 100644
+--- a/runtime/lua/vim/secure.lua
++++ b/runtime/lua/vim/secure.lua
+@@ -92,7 +92,7 @@ function M.read(path)
+ return nil
+ elseif result == 2 then
+ -- View
+- vim.cmd('sview ' .. fullpath)
++ vim.cmd(('sview %s'):format(vim.fn.fnameescape(fullpath)))
+ return nil
+ elseif result == 3 then
+ -- Deny
+diff --git a/test/functional/lua/secure_spec.lua b/test/functional/lua/secure_spec.lua
+index c58fd68..1e8a719 100644
+--- a/test/functional/lua/secure_spec.lua
++++ b/test/functional/lua/secure_spec.lua
+@@ -306,5 +306,33 @@ describe('vim.secure', function()
+ exec_lua([[return {vim.secure.trust({action='allow', bufnr=0})}]])
+ )
+ end)
++
++ it('(v)iew action does not execute malicious filename #39914', function()
++ if t.skip(t.is_os('win'), 'N/A: filename cannot have "|" char') then
++ return
++ end
++
++ local evil = 'Xfile|let g:secure_poc=42'
++ t.write_file(evil, 'pwned\n')
++ finally(function()
++ os.remove(evil)
++ end)
++
++ eq(
++ vim.NIL,
++ exec_lua([[
++ vim.fn.confirm = function()
++ return 2 -- View
++ end
++ return vim.secure.read('Xfile|let g:secure_poc=42')
++ ]])
++ )
++
++ -- Malicious injected `:let` did NOT execute.
++ eq(0, fn.exists('g:secure_poc'))
++ -- The file is opened in a [RO] split with its literal name.
++ eq(true, api.nvim_get_option_value('readonly', {}))
++ eq(evil, vim.fs.basename(api.nvim_buf_get_name(0)))
++ end)
+ end)
+ end)
diff -Nru neovim-0.10.4/debian/patches/series neovim-0.10.4/debian/patches/series
--- neovim-0.10.4/debian/patches/series 2025-03-17 22:34:18.000000000 -0400
+++ neovim-0.10.4/debian/patches/series 2026-08-12 06:54:33.000000000 -0400
@@ -2,3 +2,4 @@
testunitstrings_spec-use-correct-type-fo.patch
fixvim_snprintf-special-case-handling-of.patch
0004-Skip-flaky-tests-in-test_stat.vim.patch
+0005-fix-vim.secure-read-command-injection-vulnerability-.patch
diff -Nru neovim-0.10.4/debian/salsa-ci.yml neovim-0.10.4/debian/salsa-ci.yml
--- neovim-0.10.4/debian/salsa-ci.yml 2025-03-17 22:34:18.000000000 -0400
+++ neovim-0.10.4/debian/salsa-ci.yml 2026-08-12 06:54:33.000000000 -0400
@@ -4,3 +4,4 @@
variables:
SALSA_CI_DISABLE_REPROTEST: 1
+ RELEASE: 'trixie'
