A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context du...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Alpine:v3.23 vim

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0481-r0"}]}]

参照URL

advisory security.alpinelinux.org