Backport upstream patch 9.2.0495 (commit f08ab2f4d7d2) to fix
CVE-2026-47162 — code injection via NetrwBookHistSave() in the
netrw plugin.
The vulnerable setline() call in s:NetrwBookHistSave() used naive
string concatenation to build Vimscript let statements, allowing
code injection through crafted directory names. The fix replaces
this with string() for proper quoting.
The patch was adjusted for the RHEL 9 Vim 8.2 codebase: netrw
path changed from runtime/pack/dist/opt/netrw/autoload/ to
runtime/autoload/, and a new test file was added.
CVE: CVE-2026-47162
Upstream patches:
- f08ab2f4d7.patch
Resolves: RHEL-186655
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
