Backport upstream fix for CVE-2026-73076 which addresses code
execution via the .VimballRecord file in the vimball plugin.
The patch adds filename validation to reject .VimballRecord as
a vimball filename, sanitizes stored commands using structured
call delete() calls with safe quoting, and validates entries
in RmVimball before execution. Adapted for Vim 8.0 legacy
script syntax (no Vim9 string interpolation or method syntax).
CVE: CVE-2026-73076
Upstream patches:
- 581a2f3ac9.patch
Resolves: RHEL-242118
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
