Executive brief
Vim is a widely-used text editor that includes a plugin system for installing extensions via vimball archives. The vimball installer maintains a record file listing files to remove on uninstall, and prior to version 9.2.0847, a crafted archive could inject arbitrary commands into this record file, which would later execute with the user's privileges when any vimball operation reads the record. This allows an attacker who controls a vimball to plant persistent commands that execute in future vimball operations—even after the original malicious archive is removed.
Technical details
The vulnerability exists in runtime/autoload/vimball.vim, which maintains a .VimballRecord file containing Ex commands to undo prior vimball installations. While the plugin blocked member names containing characters that could inject commands (bars, quotes, closing parentheses), it did not block a member named .VimballRecord itself. An attacker can craft a vimball archive containing a .VimballRecord member with malicious Ex commands; when extracted, this overwrites the legitimate record file with attacker-controlled content. Later, when vimball#RmVimball() processes any vimball operation, it executes those stored commands without validation via exe, allowing arbitrary command execution including OS commands through :!. The vulnerability requires the victim to extract a malicious vimball archive, but does not require execution during extraction—commands persist in the record and fire on subsequent unrelated vimball operations. The fix (9.2.0847) forbids extraction of members named .VimballRecord and validates record entries to contain only expected deletion commands.
Affected products
- Vim Vim prior to 9.2.0847
Timeline
- 2026-07-24: disclosed
- 2026-07-24: patched: version 9.2.0847
- 2026-08-11: advisory