From: Hitendra Prajapati <[email protected]> Pick the patch from [1], also referenced in the NVD report [2].
[1] https://github.com/vim/vim/commit/2f628d8104958fa7421664f792ca6d4f7a39a10f [2] https://nvd.nist.gov/vuln/detail/CVE-2026-73073 Signed-off-by: Hitendra Prajapati <[email protected]> Signed-off-by: Yoann Congal <[email protected]> --- .../vim/files/CVE-2026-73073.patch | 105 ++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 106 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-73073.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-73073.patch b/meta/recipes-support/vim/files/CVE-2026-73073.patch new file mode 100644 index 00000000000..5defa7339e6 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-73073.patch @@ -0,0 +1,105 @@ +From 2f628d8104958fa7421664f792ca6d4f7a39a10f Mon Sep 17 00:00:00 2001 +From: Yasuhiro Matsumoto <[email protected]> +Date: Fri, 17 Jul 2026 09:11:42 +0900 +Subject: [PATCH] patch 9.2.0845: [security]: arbitrary Ex command execution + during C omni-completion + +Problem: [security]: arbitrary Ex command execution during C + omni-completion (Threonine) +Solution: Match tags typeref literally to block Ex command injection + (Yasuhiro Matsumoto). + +Escaping only "/" and "\" left the typeref able to break out of the +:vimgrep pattern without a "/": an unclosed "[" makes vimgrep's pattern +skipping fail, and the parser then treats a following "|" as a command +separator, so the tag value runs as Ex commands during C omni-completion. +Match the field literally with \V so no regex metacharacter can affect +pattern parsing. + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-cx73-phcg-3j5g + +Signed-off-by: Yasuhiro Matsumoto <[email protected]> +Signed-off-by: Christian Brabandt <[email protected]> + +CVE: CVE-2026-73073 +Upstream-Status: Backport [https://github.com/vim/vim/commit/2f628d8104958fa7421664f792ca6d4f7a39a10f] +Signed-off-by: Hitendra Prajapati <[email protected]> +--- + runtime/autoload/ccomplete.vim | 5 ++++- + src/testdir/test_plugin_ccomplete.vim | 26 ++++++++++++++++++++++++++ + src/version.c | 4 ++++ + 3 files changed, 34 insertions(+), 1 deletion(-) + +diff --git a/runtime/autoload/ccomplete.vim b/runtime/autoload/ccomplete.vim +index dc3388b524..593789a84f 100644 +--- a/runtime/autoload/ccomplete.vim ++++ b/runtime/autoload/ccomplete.vim +@@ -599,8 +599,11 @@ def StructMembers( # {{{1 + if complete_check() + return [] + endif ++ # Match "typename" literally (\V): escaping alone is not enough, as e.g. ++ # an unclosed "[" makes vimgrep's pattern skipping fail and the rest of ++ # the tag value is then parsed as Ex commands. + execute 'silent! keepjumps noautocmd ' +- .. n .. 'vimgrep ' .. '/\t' .. escape(typename, '/\') .. '\(\t\|$\)/j ' ++ .. n .. 'vimgrep ' .. '/\t\V' .. escape(typename, '/\') .. '\m\(\t\|$\)/j ' + .. fnames + + qflist = getqflist() +diff --git a/src/testdir/test_plugin_ccomplete.vim b/src/testdir/test_plugin_ccomplete.vim +index a635bd50bd..c1754d17c1 100644 +--- a/src/testdir/test_plugin_ccomplete.vim ++++ b/src/testdir/test_plugin_ccomplete.vim +@@ -31,6 +31,32 @@ func Test_ccomplete_no_exec_via_typeref() + unlet! g:ccomplete_injected + endfunc + ++" Escaping "/" and "\" is not enough: with no "/" in the payload, an unclosed ++" "[" makes vimgrep's pattern skipping fail, and the command parser then treats ++" the first "|" as a command separator. The typeref must be matched literally. ++func Test_ccomplete_no_exec_via_typeref_bracket() ++ CheckUnix ++ let sentinel = tempname() ++ call delete(sentinel) ++ let tagsfile = s:WriteTags([ ++ \ "myvar\tmain.c\t/^x$/;\"\tv\ttyperef:struct:[|call system('touch " .. sentinel .. "')|####", ++ \ ]) ++ ++ let save_tags = &tags ++ let &tags = tagsfile ++ ++ new ++ call ccomplete#Complete(1, '') ++ call ccomplete#Complete(0, 'myvar.x') ++ ++ call assert_false(filereadable(sentinel), ++ \ 'typeref field was executed as an Ex command during omni-completion') ++ ++ bwipe! ++ let &tags = save_tags ++ call delete(sentinel) ++endfunc ++ + " A legitimate typeref must still drive struct-member completion: escaping the + " field value must not break the normal path. + func Test_ccomplete_typeref_completion_still_works() +diff --git a/src/version.c b/src/version.c +index 92cd53129e..26e4e026c3 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -734,6 +734,10 @@ static char *(features[]) = + + static int included_patches[] = + { /* Add new patch number below this line */ ++/**/ ++ 845, ++/**/ ++ 846, + /**/ + 736, + /**/ +-- +2.34.1 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 34d45079061..7ab7a405ffc 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -40,6 +40,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV} file://CVE-2026-59857.patch \ file://CVE-2026-59858.patch \ file://CVE-2026-73072.patch \ + file://CVE-2026-73073.patch \ " PV .= ".0340"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245422): https://lists.openembedded.org/g/openembedded-core/message/245422 Mute This Topic: https://lists.openembedded.org/mt/121158851/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
