From 5fbbd1ab81fbfc47a9f88efed287e8cecfb83500 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Wed, 29 Jul 2026 13:35:18 +0000 Subject: [PATCH] Fix CVE-2026-59856: potential command execution in PHP omni-completion Backport upstream commit 43afc581a37a to fix CVE-2026-59856, a potential arbitrary command execution vulnerability in the PHP omni-completion plugin. The fix uses string() for safe quoting of the class name before inserting it into the search() pattern run via win_execute() in phpcomplete.vim, preventing command injection via crafted PHP files. A new test file (test_plugin_phpcomplete.vim) verifies the fix. CVE: CVE-2026-59856 Upstream patches: - https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24.patch Resolves: RHEL-201124 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- ...otential-command-execution-in-PHP-om.patch | 96 +++++++++++++++++++ vim.spec | 11 ++- 2 files changed, 106 insertions(+), 1 deletion(-) create mode 100644 0001-patch-9.2.0736-potential-command-execution-in-PHP-om.patch diff --git a/0001-patch-9.2.0736-potential-command-execution-in-PHP-om.patch b/0001-patch-9.2.0736-potential-command-execution-in-PHP-om.patch new file mode 100644 index 00000000..3972ad8b --- /dev/null +++ b/0001-patch-9.2.0736-potential-command-execution-in-PHP-om.patch @@ -0,0 +1,96 @@ +From 3175a11065e839a9b30839aff25eaa23d29ce530 Mon Sep 17 00:00:00 2001 +From: Hirohito Higashi +Date: Fri, 26 Jun 2026 20:07:01 +0900 +Subject: [PATCH] patch 9.2.0736: potential command execution in PHP + omni-completion + +Problem: With PHP omni-completion, a crafted file can potentially + execute arbitrary commands when completing a class member. +Solution: Quote the class name before inserting it into the search() + pattern run via win_execute(). + +Co-Authored-By: Claude Opus 4.8 (1M context) +Signed-off-by: Hirohito Higashi +Signed-off-by: Christian Brabandt +--- + runtime/autoload/phpcomplete.vim | 3 ++- + src/testdir/Make_all.mak | 2 ++ + src/testdir/test_plugin_phpcomplete.vim | 35 +++++++++++++++++++++++++ + 3 files changed, 39 insertions(+), 1 deletion(-) + create mode 100644 src/testdir/test_plugin_phpcomplete.vim + +diff --git a/runtime/autoload/phpcomplete.vim b/runtime/autoload/phpcomplete.vim +index 5b4263ae4..93f7d8b45 100644 +--- a/runtime/autoload/phpcomplete.vim ++++ b/runtime/autoload/phpcomplete.vim +@@ -2082,7 +2082,8 @@ function! phpcomplete#GetClassContentsStructure(file_path, file_lines, class_nam + let result = [] + let popup_id = popup_create(a:file_lines, {'hidden': v:true}) + +- call win_execute(popup_id, 'call search(''\c\(class\|interface\|trait\)\_s\+'.a:class_name.'\(\>\|$\)'')') ++ call win_execute(popup_id, 'call search(' ++ \ . string('\c\(class\|interface\|trait\)\_s\+' . a:class_name . '\(\>\|$\)') . ')') + call win_execute(popup_id, "let cfline = line('.')") + call win_execute(popup_id, "call search('{')") + call win_execute(popup_id, "let endline = line('.')") +diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak +index 2b3d16d78..c4df6ec27 100644 +--- a/src/testdir/Make_all.mak ++++ b/src/testdir/Make_all.mak +@@ -227,6 +227,7 @@ NEW_TESTS = \ + test_partial \ + test_paste \ + test_perl \ ++ test_plugin_phpcomplete \ + test_plugin_tar \ + test_plus_arg_edit \ + test_popup \ +@@ -477,6 +478,7 @@ NEW_TESTS_RES = \ + test_partial.res \ + test_paste.res \ + test_perl.res \ ++ test_plugin_phpcomplete.res \ + test_plugin_tar.res \ + test_plus_arg_edit.res \ + test_popup.res \ +diff --git a/src/testdir/test_plugin_phpcomplete.vim b/src/testdir/test_plugin_phpcomplete.vim +new file mode 100644 +index 000000000..7f66be47b +--- /dev/null ++++ b/src/testdir/test_plugin_phpcomplete.vim +@@ -0,0 +1,35 @@ ++" Tests for the PHP omni-completion plugin (runtime/autoload/phpcomplete.vim). ++ ++" A buffer class name is interpolated into a search() pattern run via ++" win_execute(). Without escaping, "'" closes the string and "|" starts a new ++" Ex command, so the name runs as an Ex command during completion. ++func Test_phpcomplete_no_exec_via_class_name() ++ unlet! g:phpcomplete_injected ++ let lines = [' 0, 'no class structure returned') ++ call assert_match('class Foo', result[0].content, ++ \ 'class body missing from returned content') ++ call assert_match('bar', result[0].content, ++ \ 'class member missing from returned content') ++endfunc ++ ++" vim: shiftwidth=2 sts=2 expandtab diff --git a/vim.spec b/vim.spec index 433ed893..b671fde6 100644 --- a/vim.spec +++ b/vim.spec @@ -51,7 +51,7 @@ Summary: The VIM editor URL: http://www.vim.org/ Name: vim Version: %{baseversion}.%{patchlevel} -Release: 15%{?dist} +Release: 16%{?dist} Epoch: 2 # swift.vim contains Apache 2.0 with runtime library exception: # which is taken as Apache-2.0 WITH Swift-exception - reported to legal as https://gitlab.com/fedora/legal/fedora-license-data/-/issues/188 @@ -159,6 +159,10 @@ Patch3023: 0001-patch-9.2.0479-security-runtime-tar-command-injectio.patch # https://redhat.atlassian.net/browse/RHEL-185864 # https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934 Patch3024: 0001-patch-9.2.0496-security-Code-Injection-in-cucumber-f.patch +# RHEL-201124 CVE-2026-59856 vim: potential command execution in PHP omni-completion +# https://redhat.atlassian.net/browse/RHEL-201124 +# https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24 +Patch3025: 0001-patch-9.2.0736-potential-command-execution-in-PHP-om.patch # uses autoconf in spec file @@ -501,6 +505,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk %patch -P 3022 -p1 -b .modeline-tests %patch -P 3023 -p1 -b .tar-cmd-inject %patch -P 3024 -p1 -b .cucumber-code-inject +%patch -P 3025 -p1 -b .php-omni-cmd-exec %build cd src @@ -1131,6 +1136,10 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags %changelog +* Wed Jul 29 2026 RHEL Packaging Agent - 2:9.1.083-16 +- RHEL-201124 CVE-2026-59856 vim: potential command execution in PHP + omni-completion + * Thu Jul 16 2026 Zdenek Dohnal - 2:9.1.083-15 - RHEL-185864 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin