From 35ece7d48c0491a6be96b19c5c4e3fb1df6e19b1 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Wed, 29 Jul 2026 12:59:49 +0000 Subject: [PATCH] Fix CVE-2026-59856: potential command execution in PHP omni-completion MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backport upstream patch 9.2.0736 (commit 43afc581) to fix CVE-2026-59856 — potential arbitrary command execution via crafted class names in PHP omni-completion. The fix modifies runtime/autoload/phpcomplete.vim to properly escape the class name with string() before inserting it into the search() pattern run via win_execute(). Includes new test file test_plugin_phpcomplete.vim with regression tests. The Make_all.mak hunk was adapted for Vim 8.2's test list layout. CVE: CVE-2026-59856 Upstream patches: - https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24.patch Resolves: RHEL-201196 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- ...tential-command-execution-in-PHP-omn.patch | 92 +++++++++++++++++++ vim.spec | 12 ++- 2 files changed, 103 insertions(+), 1 deletion(-) create mode 100644 0001-patch-9.2.0736-potential-command-execution-in-PHP-omn.patch diff --git a/0001-patch-9.2.0736-potential-command-execution-in-PHP-omn.patch b/0001-patch-9.2.0736-potential-command-execution-in-PHP-omn.patch new file mode 100644 index 00000000..dc96e4ad --- /dev/null +++ b/0001-patch-9.2.0736-potential-command-execution-in-PHP-omn.patch @@ -0,0 +1,92 @@ +From b5e0199a9b6016d29345b89381b47f8851db86d7 Mon Sep 17 00:00:00 2001 +From: RHEL Packaging Agent +Date: Wed, 29 Jul 2026 12:40:15 +0000 +Subject: [PATCH] patch 9.2.0736: potential command execution in PHP + omni-completion + +Problem: With PHP omni-completion, a crafted file can potentially + execute arbitrary commands when completing a class member. +Solution: Quote the class name before inserting it into the search() + pattern run via win_execute(). +--- + runtime/autoload/phpcomplete.vim | 3 ++- + src/testdir/Make_all.mak | 2 ++ + src/testdir/test_plugin_phpcomplete.vim | 35 +++++++++++++++++++++++++ + 3 files changed, 39 insertions(+), 1 deletion(-) + create mode 100644 src/testdir/test_plugin_phpcomplete.vim + +diff --git a/runtime/autoload/phpcomplete.vim b/runtime/autoload/phpcomplete.vim +index 4041a80..38dc1b0 100644 +--- a/runtime/autoload/phpcomplete.vim ++++ b/runtime/autoload/phpcomplete.vim +@@ -2082,7 +2082,8 @@ function! phpcomplete#GetClassContentsStructure(file_path, file_lines, class_nam + let result = [] + let popup_id = popup_create(a:file_lines, {'hidden': v:true}) + +- call win_execute(popup_id, 'call search(''\c\(class\|interface\|trait\)\_s\+'.a:class_name.'\(\>\|$\)'')') ++ call win_execute(popup_id, 'call search(' ++ \ . string('\c\(class\|interface\|trait\)\_s\+' . a:class_name . '\(\>\|$\)') . ')') + call win_execute(popup_id, "let cfline = line('.')") + call win_execute(popup_id, "call search('{')") + call win_execute(popup_id, "let endline = line('.')") +diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak +index 2430bc7..c5d6e01 100644 +--- a/src/testdir/Make_all.mak ++++ b/src/testdir/Make_all.mak +@@ -211,6 +211,7 @@ NEW_TESTS = \ + test_perl \ + test_plugin_ccomplete \ + test_plugin_tar \ ++ test_plugin_phpcomplete \ + test_plus_arg_edit \ + test_popup \ + test_popupwin \ +@@ -451,6 +452,7 @@ NEW_TESTS_RES = \ + test_perl.res \ + test_plugin_ccomplete.res \ + test_plugin_tar.res \ ++ test_plugin_phpcomplete.res \ + test_plus_arg_edit.res \ + test_popup.res \ + test_popupwin.res \ +diff --git a/src/testdir/test_plugin_phpcomplete.vim b/src/testdir/test_plugin_phpcomplete.vim +new file mode 100644 +index 0000000..7f66be4 +--- /dev/null ++++ b/src/testdir/test_plugin_phpcomplete.vim +@@ -0,0 +1,35 @@ ++" Tests for the PHP omni-completion plugin (runtime/autoload/phpcomplete.vim). ++ ++" A buffer class name is interpolated into a search() pattern run via ++" win_execute(). Without escaping, "'" closes the string and "|" starts a new ++" Ex command, so the name runs as an Ex command during completion. ++func Test_phpcomplete_no_exec_via_class_name() ++ unlet! g:phpcomplete_injected ++ let lines = [' 0, 'no class structure returned') ++ call assert_match('class Foo', result[0].content, ++ \ 'class body missing from returned content') ++ call assert_match('bar', result[0].content, ++ \ 'class member missing from returned content') ++endfunc ++ ++" vim: shiftwidth=2 sts=2 expandtab diff --git a/vim.spec b/vim.spec index 58afa57e..517ab02f 100644 --- a/vim.spec +++ b/vim.spec @@ -27,7 +27,7 @@ Summary: The VIM editor URL: http://www.vim.org/ Name: vim Version: %{baseversion}.%{patchlevel} -Release: 34%{?dist} +Release: 35%{?dist} License: Vim and MIT Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2 Source1: virc @@ -211,6 +211,11 @@ Patch3073: 0001-patch-9.2.0496-security-Code-Injection-in-cucumber-f.patch # https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e # adjusted: kept legacy Vimscript style (exe/keepj/.); added source check.vim for CheckUnix Patch3074: 0001-patch-9.2.0735-security-arbitrary-Ex-command-executi.patch +# RHEL-201196 CVE-2026-59856 potential command execution in PHP omni-completion +# https://redhat.atlassian.net/browse/RHEL-201196 +# https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24 +# adjusted: adapted Make_all.mak hunk for Vim 8.2 test list, stripped src/version.c +Patch3075: 0001-patch-9.2.0736-potential-command-execution-in-PHP-omn.patch # gcc is no longer in buildroot by default @@ -473,6 +478,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk %patch -P 3072 -p1 -b .tar-cmd-inject %patch -P 3073 -p1 -b .cucumber-code-inject %patch -P 3074 -p1 -b .ccomplete-typeref-escape +%patch -P 3075 -p1 -b .phpcomplete-cmd-exec %build cd src @@ -1025,6 +1031,10 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags %endif %changelog +* Wed Jul 29 2026 RHEL Packaging Agent - 2:8.2.2637-35 +- RHEL-201196 CVE-2026-59856 vim: potential command execution in PHP + omni-completion + * Wed Jul 29 2026 RHEL Packaging Agent - 2:8.2.2637-34 - RHEL-203984 CVE-2026-59858 vim: arbitrary Ex command execution during C omni-completion