import UBI vim-8.2.2637-26.el9_8.6

SOURCES/0001-patch-9.2.0357-security-command-injection-via-backti.patch

@@ -0,0 +1,72 @@
+From c78194e41d5a0b05b0ddf383b6679b1503f977fb Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Wed, 15 Apr 2026 20:17:17 +0000
+Subject: [PATCH] patch 9.2.0357: [security]: command injection via backticks
+ in tag files
+
+Problem:  [security]: command injection via backticks in tag files
+          (Srinivas Piskala Ganesh Babu, Andy Ngo)
+Solution: Disallow backticks before attempting to expand filenames.
+
+Github Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8
+
+Supported by AI
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+---
+ src/tag.c                    |  4 +++-
+ src/testdir/test_tagjump.vim | 22 ++++++++++++++++++++++
+ src/version.c                |  2 ++
+ 3 files changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/src/tag.c b/src/tag.c
+index d3e27e602..0f12e384b 100644
+--- a/src/tag.c
++++ b/src/tag.c
+@@ -4137,8 +4137,10 @@ expand_tag_fname(char_u *fname, char_u *tag_fname, int expand)
+ 
+     /*
+      * Expand file name (for environment variables) when needed.
++     * Disallow backticks, they could execute arbitrary shell
++     * commands.  This is not needed for tag filenames.
+      */
+-    if (expand && mch_has_wildcard(fname))
++    if (expand && mch_has_wildcard(fname) && vim_strchr(fname, '`') == NULL)
+     {
+ 	ExpandInit(&xpc);
+ 	xpc.xp_context = EXPAND_FILES;
+diff --git a/src/testdir/test_tagjump.vim b/src/testdir/test_tagjump.vim
+index bbab3c70e..c0fa7b02e 100644
+--- a/src/testdir/test_tagjump.vim
++++ b/src/testdir/test_tagjump.vim
+@@ -1449,4 +1449,26 @@
+   set tags&
+ endfunc
+
++" Test that backtick expressions in tag filenames are not expanded.
++" This prevents command injection via malicious tags files.
++func Test_tag_backtick_filename_not_expanded()
++  let pwned_file = 'Xtags_pwnd'
++  call assert_false(filereadable(pwned_file))
++
++  let tagline = "main\t`touch " .. pwned_file .. "`\t/^int main/;\"\tf"
++  call writefile([tagline], 'Xbt_tags', 'D')
++  call writefile(['int main(int argc, char **argv) {', '}'], 'Xbt_main.c', 'D')
++
++  set tags=Xbt_tags
++  sp Xbt_main.c
++
++  " The :tag command should fail to find the file, but must NOT execute
++  " the backtick shell command.
++  call assert_fails('tag main', 'E429:')
++  call assert_false(filereadable(pwned_file))
++
++  set tags&
++  bwipe!
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+-- 
+2.54.0
+

SPECS/vim.spec

@@ -27,7 +27,7 @@ Summary: The VIM editor
 URL:     http://www.vim.org/
 Name: vim
 Version: %{baseversion}.%{patchlevel}
-Release: 26%{?dist}.5
+Release: 26%{?dist}.6
 License: Vim and MIT
 Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
 Source1: virc
@@ -184,9 +184,18 @@ Patch3067: 0001-patch-9.2.0277-tests-test_modeline.vim-fails.patch
 # https://github.com/vim/vim/commit/7088926316d8
 # https://github.com/vim/vim/commit/46f530e517bd
 # https://github.com/vim/vim/commit/351a16c88f56
+# Changes from upstream:
+# - all three: use 'echohl Error' instead of s:Mess() (not in older zip.vim)
+# - 9.2.0299: 'zipfile:' URI pattern instead of 'zipfile://' (older format);
+#   dropped TODO comment and pi_zip.txt version line update
+# - 9.2.0304: dropped Windows regex fix in zip#Write() (code path not present)
 Patch3068: 0001-patch-9.2.0280-security-path-traversal-issue-in-zip.patch
 Patch3069: 0001-patch-9.2.0299-zip-may-write-using-absolute-paths.patch
 Patch3070: 0001-patch-9.2.0304-zip-block-absolute-paths-in-Extract.patch
+# RHEL-171495 CVE-2026-41411 vim: Command injection via backticks in tag files
+# https://redhat.atlassian.net/browse/RHEL-171495
+# https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb
+Patch3071: 0001-patch-9.2.0357-security-command-injection-via-backti.patch
 
 
 # gcc is no longer in buildroot by default
@@ -445,6 +454,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
 %patch -P 3068 -p1 -b .zip-path-traversal
 %patch -P 3069 -p1 -b .zip-abs-write
 %patch -P 3070 -p1 -b .zip-abs-extract
+%patch -P 3071 -p1 -b .tag-backtick-inject
 
 %build
 cd src
@@ -997,6 +1007,9 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
 %endif
 
 %changelog
+* Thu May 21 2026 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-26.6
+- CVE-2026-41411 vim: Command injection via backticks in tag files
+
 * Wed May 20 2026 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-26.5
 - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite
   via path traversal bypass