On Wed Jul 22, 2026 at 2:33 PM CEST, Vijay Anusuri via lists.openembedded.org
wrote:
> Pick patch per [1].
>
> [1] https://nvd.nist.gov/vuln/detail/CVE-2026-57453
> [2] https://github.com/vim/vim/security/advisories/GHSA-x5fg-h5w9-9frf
>
> Signed-off-by: Vijay Anusuri <[email protected]>
> ---
> .../vim/files/CVE-2026-57453.patch | 248 ++++++++++++++++++
> meta/recipes-support/vim/vim.inc | 1 +
> 2 files changed, 249 insertions(+)
> create mode 100644 meta/recipes-support/vim/files/CVE-2026-57453.patch
>
> diff --git a/meta/recipes-support/vim/files/CVE-2026-57453.patch
> b/meta/recipes-support/vim/files/CVE-2026-57453.patch
> new file mode 100644
> index 0000000000..d1ad6d6f54
> --- /dev/null
> +++ b/meta/recipes-support/vim/files/CVE-2026-57453.patch
> @@ -0,0 +1,248 @@
> +From b2cc9be119d51212bf0d3f2a994c7e517c73f4a9 Mon Sep 17 00:00:00 2001
> +From: Christian Brabandt <[email protected]>
> +Date: Sat, 20 Jun 2026 15:35:58 +0000
> +Subject: [PATCH] patch 9.2.0678: [security]: potential powershell code
> + execution in zip.vim
> +
> +Problem: [security]: potential powershell code execution in zip.vim
> + (DDugs)
> +Solution: Cleanup zip.vim, introduce PSEscape() to escape() potential
> powershell code,
> + use consistent s:Escape() in the various PowerShell functions
> +
> +Github Security Advisory:
> +https://github.com/vim/vim/security/advisories/GHSA-x5fg-h5w9-9frf
> +
> +Signed-off-by: Christian Brabandt <[email protected]>
> +
> +Upstream-Status: Backport
> [https://github.com/vim/vim/commit/b2cc9be119d51212bf0d3f2a994c7e517c73f4a9]
> +CVE: CVE-2026-57453
> +Signed-off-by: Vijay Anusuri <[email protected]>
> +---
> + runtime/autoload/zip.vim | 78 +++++++++++++++++++---------------------
> + runtime/doc/pi_zip.txt | 10 ------
> + 2 files changed, 36 insertions(+), 52 deletions(-)
> +
> +diff --git a/runtime/autoload/zip.vim b/runtime/autoload/zip.vim
> +index f4482fd7fc..752503a626 100644
> +--- a/runtime/autoload/zip.vim
> ++++ b/runtime/autoload/zip.vim
> [...]
> +@@ -339,9 +331,9 @@ fun! zip#Read(fname,mode)
> + let temp = tempname()
> + let fn = expand('%:p')
> +
> +- let gnu_cmd = g:zip_unzipcmd . ' -p -- ' . s:Escape(zipfile, 0) . ' ' .
> s:Escape(fname, 0) . ' > ' . s:Escape(temp, 0)
> +- let gnu_cmd = 'call system(''' . substitute(gnu_cmd, "'", "''", 'g') .
> ''')'
> +- let ps_cmd = 'sil !' . s:ZipReadPS(zipfile, fname, temp)
> ++ let gnu_cmd = g:zip_unzipcmd . ' -p -- ' . s:Escape(zipfile) . ' ' .
> s:Escape(fname) . ' > ' . s:Escape(temp)
> ++ let gnu_cmd = 'call system(' . string(gnu_cmd) . ')'
> ++ let ps_cmd = $"call system({string(s:ZipDeleteFilePS(zipfile, fname))})"
The above line changed from the upstream commit? Can you explain why?
The change is:
-+ let ps_cmd = 'call system(' . string(s:ZipReadPS(zipfile, fname, temp)) .
')'
++ let ps_cmd = $"call system({string(s:ZipDeleteFilePS(zipfile, fname))})"
In the meantime, I'll hold this patch but continue to review the
reminder of the series (hoping those CVE fixes are independant enought
to avoid a conflict).
--
Yoann Congal
Smile ECS
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#242023):
https://lists.openembedded.org/g/openembedded-core/message/242023
Mute This Topic: https://lists.openembedded.org/mt/120392654/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
