Backport fix for CVE-2026-59858 from upstream commit 6b611b0d
to vim 8.0. A crafted typeref field in a tags file could break
out of the :vimgrep pattern in ccomplete.vim's s:StructMembers()
and execute arbitrary Ex commands during C omni-completion. The
fix escapes the typename variable with escape(typename, '/\')
before interpolation into the pattern. The patch was adapted from
vim9script syntax to legacy Vim script for the 8.0 codebase, and
includes test coverage for both the security fix and regression
testing of legitimate typeref completion.
CVE: CVE-2026-59858
Upstream patches:
- 6b611b0d15.patch
Resolves: RHEL-203873
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix (commit a80874d9) for CVE-2026-55693,
an out-of-bounds write in tree_count_words() and
sug_filltree() in src/spellfile.c. A crafted spell file
could drive these functions past the end of their
MAXWLEN-sized depth arrays because the descent loops had
no depth bound. The patch adds depth checks and includes
an adapted test for vim 8.0.
CVE: CVE-2026-55693
Upstream patches:
- a80874d9b8.patch
Resolves: RHEL-194055
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 497f931f to fix an out-of-bounds
write in spell_soundfold_sofo() (CVE-2026-57455). The patch
adds a bounds check (ri < MAXWLEN - 1) to the for loop in the
single-byte SOFO soundfold branch of src/spell.c to prevent
a stack buffer overflow when processing words longer than
MAXWLEN. The test was adapted for Vim 8.0 (no defer/D flag)
and registered in Make_all.mak.
CVE: CVE-2026-57455
Upstream patches:
- 497f931f85.patch
Resolves: RHEL-191365
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit cce141c42740f122dd8486ae04e21c2a81016ba8
to fix CVE-2026-57456: possible code execution with python complete
via crafted docstrings.
The fix replaces unsafe triple-quote string concatenation with
repr() in python3complete.vim and pythoncomplete.vim to properly
sanitize docstrings before exec(). A new test file adapted for
vim 8.0 is included to verify the fix.
CVE: CVE-2026-57456
Upstream patches:
- cce141c427.patch
Resolves: RHEL-192102
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport fix for CVE-2026-52858 to vim on c8s. Two upstream
patches are applied:
- Patch 3059 (upstream 9.2.0561): Disables execution of
import/from statements in python3complete.vim and
pythoncomplete.vim unless g:pythoncomplete_allow_import
is explicitly set by the user.
- Patch 3060 (upstream 9.2.0568): Follow-up fix adding
missing 'import vim' in evalsource() so the opt-in
variable is actually honored.
Both patches had src/version.c hunks stripped per
maintainer rules. Minor conflicts in filetype.txt and
test_popup.vim were resolved manually due to differences
between vim 8.0 and upstream.
CVE: CVE-2026-52858
Upstream patches:
- 4b850457e1.patch
- 868ad62cb8.patch
Resolves: RHEL-186648
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix for CVE-2026-47162 which addresses a code
injection vulnerability in the netrw plugin's
NetrwBookHistSave() function. The fix uses string() to properly
quote directory names written to the netrw history file,
preventing malicious directory names from executing arbitrary
Vim commands when the history is sourced.
The patch was adapted from upstream commit f08ab2f4d7d2 for
vim 8.0: adjusted file path to runtime/autoload/netrw.vim,
adapted the setline() call to the downstream loop pattern,
and created a minimal test file for the injection scenario.
CVE: CVE-2026-47162
Upstream patches:
- f08ab2f4d7.patch
Resolves: RHEL-186656
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix (commit a65a52d6) for CVE-2026-47167 to
vim 8.0.1763 on c8s. The patch replaces the unsafe
Kernel.eval('/'+pattern+'/') call in cucumber.vim with
Regexp.new(pattern), preventing Ruby code injection through
malicious step definition patterns.
Added Patch3059 with adaptations for vim 8.0: replaced
CheckFeature with has() guard and adjusted mkdir/cleanup
calls for compatibility.
CVE: CVE-2026-47167
Upstream patches:
- a65a52d684.patch
Resolves: RHEL-185863
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1
to fix a command injection vulnerability (CVE-2026-46483) in
the vim tar plugin. The fix changes shellescape(tartail) to
shellescape(tartail, 1) in two places in the tar#Vimuntar()
function in runtime/autoload/tar.vim, ensuring proper shell
escaping when executing external commands via :! commands.
The patch was manually adapted for vim 8.0, omitting the
src/version.c hunk and the Vim9-based test file which are not
compatible with this version.
CVE: CVE-2026-46483
Upstream patches:
- 3fb5e58fbc.patch
Resolves: RHEL-178234
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
