From 5ba4711ff359f171d675c893ce3976ffb1597a36 Mon Sep 17 00:00:00 2001
From: Zdenek Dohnal <zdohnal@redhat.com>
Date: Thu, 16 Jul 2026 15:11:07 +0200
Subject: [PATCH] CVE-2026-46483 vim: command injection in tar plugin

Resolves: RHEL-178242
---
 ...ecurity-runtime-tar-command-injectio.patch | 91 +++++++++++++++++++
 vim.spec                                      | 10 +-
 2 files changed, 100 insertions(+), 1 deletion(-)
 create mode 100644 0001-patch-9.2.0479-security-runtime-tar-command-injectio.patch

diff --git a/0001-patch-9.2.0479-security-runtime-tar-command-injectio.patch b/0001-patch-9.2.0479-security-runtime-tar-command-injectio.patch
new file mode 100644
index 00000000..3599a5cc
--- /dev/null
+++ b/0001-patch-9.2.0479-security-runtime-tar-command-injectio.patch
@@ -0,0 +1,91 @@
+From a51ca3f97ec9362366c918d37905b3a083eff82e Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Thu, 14 May 2026 15:35:28 +0000
+Subject: [PATCH] patch 9.2.0479: [security]: runtime(tar): command injection
+ in tar plugin
+
+Problem:  [security]: runtime(tar): command injection in tar plugin
+          (Christopher Lusk)
+Solution: Use the correct shellescape(args, 1) form for a :! command
+
+Github Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+---
+ runtime/autoload/tar.vim        |  4 ++--
+ src/testdir/Make_all.mak        |  2 ++
+ src/testdir/test_plugin_tar.vim | 24 ++++++++++++++++++++++++
+ 3 files changed, 28 insertions(+), 2 deletions(-)
+ create mode 100644 src/testdir/test_plugin_tar.vim
+
+diff --git a/runtime/autoload/tar.vim b/runtime/autoload/tar.vim
+index 13df5790a..ef7b21499 100644
+--- a/runtime/autoload/tar.vim
++++ b/runtime/autoload/tar.vim
+@@ -774,9 +774,9 @@ fun! tar#Vimuntar(...)
+   " if necessary, decompress the tarball; then, extract it
+   if tartail =~ '\.tgz'
+    if executable("gunzip")
+-    silent exe "!gunzip ".shellescape(tartail)
++    silent exe "!gunzip ".shellescape(tartail, 1)
+    elseif executable("gzip")
+-    silent exe "!gzip -d ".shellescape(tartail)
++    silent exe "!gzip -d ".shellescape(tartail, 1)
+    else
+     echoerr "unable to decompress<".tartail."> on this sytem"
+     if simplify(curdir) != simplify(tarhome)
+diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
+index 111111111..222222222 100644
+--- a/src/testdir/Make_all.mak
++++ b/src/testdir/Make_all.mak
+@@ -209,6 +209,7 @@ NEW_TESTS = \
+ 	test_paste \
+ 	test_perl \
++	test_plugin_tar \
+ 	test_plus_arg_edit \
+ 	test_popup \
+ 	test_popupwin \
+ 	test_popupwin_textprop \
+@@ -447,6 +448,7 @@ NEW_TESTS_RES = \
+ 	test_paste.res \
+ 	test_perl.res \
++	test_plugin_tar.res \
+ 	test_plus_arg_edit.res \
+ 	test_popup.res \
+ 	test_popupwin.res \
+ 	test_popupwin_textprop.res \
+diff --git a/src/testdir/test_plugin_tar.vim b/src/testdir/test_plugin_tar.vim
+new file mode 100644
+index 000000000..000000001
+--- /dev/null
++++ b/src/testdir/test_plugin_tar.vim
+@@ -0,0 +1,25 @@
++vim9script
++
++source check.vim
++CheckNotMSWindows
++
++runtime plugin/tarPlugin.vim
++
++def g:Test_extract_command_injection()
++  CheckExecutable gunzip
++  CheckExecutable touch
++  var tgz = eval('0z1F8B08087795056A000364756D6D792E74617200EDCE2B12C2300004D01C254' ..
++   '7480269CE534080A8495BD1DBF3996106C3A08A7ACFACD8157B59A7690BFB4A0FC3707C666E357D' ..
++   'E65BC8B5A47CC8A5D61A522EA5B510D3CEBF5ED679197B8CE17CEDB7F9D4C76FBB5F3D000000000' ..
++   '000000000FCD11D32415E2C00280000')
++  var dirname = tempname()
++
++  mkdir(dirname, 'R')
++  var tar = dirname .. "/';%$(touch pwned)'.tgz"
++  writefile(tgz, tar)
++  new
++  exe "e " .. fnameescape(tar)
++  exe ":Vimuntar " .. dirname
++  assert_false(filereadable(dirname .. "/pwned"))
++  bw!
++enddef
+--
+2.52.0
+
diff --git a/vim.spec b/vim.spec
index 532aca7b..8cdd344e 100644
--- a/vim.spec
+++ b/vim.spec
@@ -27,7 +27,7 @@ Summary: The VIM editor
 URL:     http://www.vim.org/
 Name: vim
 Version: %{baseversion}.%{patchlevel}
-Release: 31%{?dist}
+Release: 32%{?dist}
 License: Vim and MIT
 Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
 Source1: virc
@@ -198,6 +198,10 @@ Patch3069: 0001-patch-9.2.0357-security-command-injection-via-backti.patch
 # https://github.com/vim/vim/commit/8c8772c6b321d4955c8f09926e3eda2b4cd83680
 Patch3070: 0001-patch-9.2.0276-security-modeline-security-bypass.patch
 Patch3071: 0001-patch-9.2.0277-tests-test_modeline.vim-fails.patch
+# RHEL-178242 CVE-2026-46483 runtime(tar): command injection in tar plugin
+# https://redhat.atlassian.net/browse/RHEL-178242
+# https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1
+Patch3072: 0001-patch-9.2.0479-security-runtime-tar-command-injectio.patch
 
 
 # gcc is no longer in buildroot by default
@@ -457,6 +461,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
 %patch -P 3069 -p1 -b .tag-backtick-inject
 %patch -P 3070 -p1 -b .modeline-bypass
 %patch -P 3071 -p1 -b .modeline-tests
+%patch -P 3072 -p1 -b .tar-cmd-inject
 
 %build
 cd src
@@ -1009,6 +1014,9 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
 %endif
 
 %changelog
+* Thu Jul 16 2026 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-32
+- RHEL-178242 CVE-2026-46483 vim: command injection in tar plugin
+
 * Wed May 27 2026 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-31
 - CVE-2026-34982 vim: arbitrary command execution via modeline sandbox bypass