huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-33982: FreeRDP: FreeRDP: Information disclosure and denial of service via heap-buffer-overflow read
Component: FreeRDP
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H)
Public date: 2026-03-30T21:42:11.982000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. This vulnerability, a heap-buffer-overflow read, exists in the `winpr_aligned_offset_recalloc()` function. A local attacker could exploit this flaw, with user interaction, to read sensitive information from memory, leading to information disclosure, or cause the application to crash, resulting in a denial of service.

Statement: Red Hat systems require user authentication in order to interact with FreeRDP binaries. Unauthenticated interaction is not possible in default configurations and so the risk posed by this flaw is slightly mitigated to Red hat customers.

Affected upstream versions: < 3.24.2
Fixed upstream versions: 3.25.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: a48dbde2c8a5b8b70a9d1c045d969a71afd6284c
CVE-2026-33983: FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages
Component: FreeRDP
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-03-30T21:42:27.798000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). A remote attacker could exploit this vulnerability by sending a specially crafted RDP message. This can lead to an undefined behavior where a wrapped value is used as a shift exponent, causing an approximately 80 billion iteration loop. This results in a Denial of Service (DoS) due to excessive CPU utilization.


Affected upstream versions: < 3.24.2
Fixed upstream versions: 3.25.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 78188ab479c8e6eb9ba2475b3732c76b4bbe5425
CVE-2026-33984: FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data
Component: FreeRDP
Severity: Important
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-03-30T21:42:57.090000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A remote attacker could exploit a heap buffer overflow vulnerability in the `resize_vbar_entry()` function. This occurs when an error in buffer resizing leads to attacker-controlled pixel data being written into an undersized memory buffer. Successful exploitation could result in arbitrary code execution.


Affected upstream versions: < 3.24.2
Fixed upstream versions: 3.25.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: dc7fdb165095139be779a4000199bc1706b06ad5
CVE-2026-33985: FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read
Component: FreeRDP
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2026-03-30T21:43:13.335000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A remote attacker could exploit a vulnerability where pixel data from adjacent heap memory is rendered to the screen. This can lead to the disclosure of sensitive data to the attacker.


Affected upstream versions: < 3.24.2
Fixed upstream versions: 3.25.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: c49d1ad43b8c7b32794d0250f2623c2dccd7ef25
CVE-2026-33987: FreeRDP: FreeRDP: Memory corruption vulnerability allows denial of service or arbitrary code execution
Component: FreeRDP
Severity: Moderate
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-03-30T21:43:39.943000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A memory corruption vulnerability exists in the persistent cache handling. If a memory reallocation fails, an internal size variable is incorrectly updated, while the data pointer still refers to the original, smaller memory block. This can allow a local attacker, through user interaction, to cause a denial of service or potentially execute arbitrary code.


Affected upstream versions: < 3.24.2
Fixed upstream versions: 3.25.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 1a890eb43492b5eb707cb3dd6fc908f696e8fc1c
CVE-2026-34043: serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization
Component: serialize-javascript
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-03-31T01:48:45.759000+00:00

A flaw was found in serialize-javascript. An attacker can exploit this vulnerability by providing a specially crafted "array-like" object with an excessively large length property during the serialization process. This action causes the application to enter an intensive loop, leading to 100% CPU consumption and an indefinite hang. The primary consequence is a Denial of Service (DoS), making the affected system unresponsive.

Statement: Red Hat products in their default configurations do not accept input from unauthenticated users.

Affected upstream versions: < 7.0.5
Fixed upstream versions: v7.0.5
Upstream repository: https://github.com/yahoo/serialize-javascript
Upstream fix commit: f147e90269b58bb6e539cfdf3d0e20d6ad14204b
CVE-2026-34070: langchain: path traversal in legacy load_prompt functions in langchain-core
Component: langchain
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2026-03-31T02:01:49.320000+00:00

A flaw was found in LangChain. Multiple functions in `langchain_core.prompts.loading` read files from paths embedded in deserialized configuration dictionaries without validation for directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to `load_prompt()` or `load_prompt_from_config()`, an attacker can read arbitrary files on the host filesystem.

Statement: This flaw is exploitable in applications that accept prompt configs from untrusted sources, including low-code AI builders and API wrappers that expose `load_prompt_from_config()`.

Also, the affected functions (`load_prompt`, `load_prompt_from_config` and the `.save()` method on prompt classes) are undocumented legacy APIs. They are superseded by the `dumpd`/`dumps`/`load`/`loads` serialization APIs in `langchain_core.load`, which do not perform filesystem reads and use an allowlist-based security model.

An attacker who controls or influences the prompt configuration dictionary can read files outside the intended directory, such as cloud-mounted secrets, internal system prompts, cloud credentials, Kubernetes manifests, CI/CD configs and application settings.

Due to these reasons, this vulnerability has been rated with an important severity.

Affected upstream versions: < 1.2.22
Fixed upstream versions: langchain-model-profiles==0.0.6
Upstream repository: https://github.com/langchain-ai/langchain
Upstream fix commit: 27add913474e01e33bededf4096151130ba0d47c
CVE-2026-34085: fontconfig: Fontconfig: Security flaw allows arbitrary code execution or system crash
Component: fontconfig
Severity: Moderate
CWE: CWE-193 (Off-by-one Error)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
Public date: 2026-03-25T16:54:37.187000+00:00

A flaw was found in fontconfig. This vulnerability, an off-by-one error in how fontconfig handles font capabilities, could allow a local attacker to cause a one-byte out-of-bounds write. This issue may lead to a system crash, resulting in a Denial of Service (DoS), or potentially enable the attacker to execute unauthorized code.

Statement: This vulnerability is rated Moderate severity by Red Hat Product Security. The issue arises from a memory handling flaw in font processing, which can cause applications such as fc-cache to crash when processing a specially crafted font file.

Exploitation requires a user to install or process a malicious font, meaning the issue cannot be triggered remotely without user interaction. While the crash may disrupt system functionality: for example, affecting graphical login services or applications that rely on font rendering, the impact is limited to application stability.

The underlying flaw involves a very small memory overwrite (one byte), which significantly limits the ability to exploit it for more serious outcomes such as executing arbitrary code or fully compromising the system. There is no evidence that the vulnerability can be reliably used to gain control over a system or access sensitive data.

Red Hat therefore assesses the primary impact as a denial of service in user-space components, resulting in a Moderate severity rating.

Affected upstream versions: <= ah-20021030-postdri
Fixed upstream versions: 2.17.1
Upstream repository: https://gitlab.freedesktop.org/fontconfig/fontconfig
Upstream fix commit: b9bec06d73340f1b5727302d13ac3df307b7febc
CVE-2026-34180: openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure.
Component: openssl
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H)
Public date: 2026-06-09T00:00:00+00:00

A flaw was found in OpenSSL. An integer truncation vulnerability in the ASN.1 decoder can occur when processing a crafted DER-encoded ASN.1 structure with a primitive element exceeding 2 gigabytes. A remote attacker could exploit this to cause a heap buffer over-read. This may lead to an application crash, resulting in a Denial of Service (DoS), or potentially disclose sensitive information by loading memory contents beyond the input buffer. This issue primarily affects 64-bit Unix and Unix-like platforms.

Statement: This Low impact vulnerability in OpenSSL's ASN.1 decoder affects 64-bit Unix-like platforms, where processing a crafted DER-encoded ASN.1 structure exceeding 2 gigabytes can lead to a heap buffer over-read. This may result in application crashes (Denial of Service) or unintended memory exposure. Red Hat products are only affected if they process untrusted, excessively large ASN.1 input using OpenSSL's d2i_* decoding functions.

Affected upstream versions: 4.0.0 < 4.0.1, 3.6.0 < 3.6.3, 3.5.0 < 3.5.7, 3.4.0 < 3.4.6, 3.0.0 < 3.0.21, 1.1.1 < 1.1.1zh, 1.0.2 < 1.0.2zq
Fixed upstream versions: 1.0.2zq, 1.1.1zh, 3.0.21, 3.4.6, 3.5.7, 3.6.3, 4.0.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: f696c73c3e61b8c502d040af62e690c060908a16
CVE-2026-34181: openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys
Component: openssl
Severity: Low
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Public date: 2026-06-09T00:00:00+00:00

A flaw was found in OpenSSL. This vulnerability allows a remote attacker to forge PKCS#12 (Public-Key Cryptography Standards #12) files that use Password-Based Message Authentication Code 1 (PBMAC1) with short HMAC (Hash-based Message Authentication Code) keys. This can lead to a service accepting attacker-controlled certificates and private keys with a 1 in 256 probability, potentially enabling impersonation.

Statement: Low: This flaw allows an attacker to forge PKCS#12 files with a 1 in 256 probability, leading to the acceptance of attacker-controlled certificates and private keys by services configured to use PBMAC1 authentication. Red Hat products utilizing OpenSSL versions 3.0, 1.1.1, or 1.0.2 are not affected, as these versions do not support PBMAC1 in PKCS#12.

Affected upstream versions: 4.0.0 < 4.0.1, 3.6.0 < 3.6.3, 3.5.0 < 3.5.7, 3.4.0 < 3.4.6
Fixed upstream versions: 3.4.6, 3.5.7, 3.6.3, 4.0.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 0300eb9ddce7a0895bf301a4b0c03a9da2313a0f
CVE-2026-34182: openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages
Component: openssl
Severity: Moderate
CWE: CWE-130 (Improper Handling of Length Parameter Inconsistency)
CVSS v3: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2026-06-09T00:00:00+00:00

A flaw was found in OpenSSL's Cryptographic Message Services (CMS) AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity validation. Consequently, an attacker may achieve key-equivalent functionality for a given CMS recipient.

Statement: Moderate: This flaw in OpenSSL's Cryptographic Message Services (CMS) AuthEnvelopedData processing could allow an on-path attacker to forge messages or bypass integrity validation. This is due to insufficient input validation on cipher and tag length fields, potentially leading to key-equivalent functionality or integrity bypass in applications utilizing affected OpenSSL versions for CMS AuthEnvelopedData.

Affected upstream versions: 4.0.0 < 4.0.1, 3.6.0 < 3.6.3, 3.5.0 < 3.5.7, 3.4.0 < 3.4.6, 3.0.0 < 3.0.21
Fixed upstream versions: 3.0.21, 3.4.6, 3.5.7, 3.6.3, 4.0.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 9fd97f8cfdc2c0be214998de3b2b55c8edf6c7ac
CVE-2026-34183: openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler
Component: openssl
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-06-09T00:00:00+00:00

A flaw was found in OpenSSL's QUIC PATH_CHALLENGE handler. A remote attacker can exploit this vulnerability by flooding a QUIC client or server with specially crafted PATH_CHALLENGE frames. This leads to unbounded memory allocation within the local QUIC stack, as the system continuously allocates PATH_RESPONSE frames without them being acknowledged. The primary consequence is a Denial of Service (DoS), causing the affected application to terminate abnormally due to memory exhaustion.

Statement: A Moderate severity flaw exists in the QUIC PATH_CHALLENGE handler, allowing a remote attacker to exhaust heap memory of a QUIC client or server. By flooding the local QUIC stack with PATH_CHALLENGE frames, a malicious peer can trigger unbounded memory allocation, leading to a denial of service for applications utilizing the vulnerable QUIC implementation.

Affected upstream versions: 4.0.0 < 4.0.1, 3.6.0 < 3.6.3, 3.5.0 < 3.5.7, 3.4.0 < 3.4.6
Fixed upstream versions: 3.4.6, 3.5.7, 3.6.3, 4.0.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: fbaa83859c01ad64f497b757aaf51be7d05ed9eb
CVE-2026-34352: TigerVNC: x0vncserver: TigerVNC x0vncserver: Information disclosure, data manipulation, and denial of service via incorrect permissions
Component: TigerVNC
Severity: Moderate
CWE: CWE-279 (Incorrect Execution-Assigned Permissions)
CVSS v3: 6.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L)
Public date: 2026-03-26T22:30:46.928000+00:00

A flaw was found in TigerVNC's x0vncserver component. Due to incorrect permissions in the Image.cxx file, other users on the system can observe or manipulate the screen contents of a running session. This vulnerability could also lead to an application crash, resulting in a Denial of Service (DoS).


Affected upstream versions: <= v1.1.90
Fixed upstream versions: 1.16.2
Upstream repository: https://github.com/TigerVNC/tigervnc
Upstream fix commit: 0b5cab169d847789efa54459a87659d3fd484393
CVE-2026-3446: python: Python base64: Incomplete data decoding due to premature stop at padding
Component: python
Severity: Moderate
CWE: CWE-1286 (Improper Validation of Syntactic Correctness of Input)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N)
Public date: 2026-04-10T18:17:35.045000+00:00

A flaw was found in the Python base64 module. When decoding base64 data using functions like base64.b64decode(), the decoding process prematurely stops upon encountering the first padding character. This can result in incomplete data being processed, where any information following the initial padding is unexpectedly ignored. Consequently, applications might interpret or handle base64-encoded data inconsistently compared to other implementations, potentially leading to data integrity issues.


Affected upstream versions: 3.14.0 < 3.14.4, 3.15.0a1 < 3.15.0a8
Fixed upstream versions: v3.13.13
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 1f9958f909c1b41a4ffc0b613ef8ec8fa5e7c474
CVE-2026-34742: github.com/modelcontextprotocol/go-sdk: Model Context Protocol (MCP) Go SDK: DNS rebinding vulnerability allows unauthorized access
Component: github.com/modelcontextprotocol/go-sdk
Severity: Important
CWE: CWE-1188 (Initialization of a Resource with an Insecure Default)
CVSS v3: 8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N)
Public date: 2026-04-02T18:32:34.781000+00:00

A flaw was found in the Model Context Protocol (MCP) Go SDK. When an HTTP-based MCP server is run on localhost without authentication, a malicious website can exploit a DNS rebinding vulnerability. This allows the attacker to bypass same-origin policy restrictions and send requests to the local MCP server. Consequently, an attacker could invoke tools or access resources exposed by the MCP server on behalf of the user.


Affected upstream versions: < 1.4.0
Fixed upstream versions: v1.4.0
Upstream repository: https://github.com/modelcontextprotocol/go-sdk
Upstream fix commit: 67bd3f2e2b53ce11a16db8d976cdb8ff1e986b6d
CVE-2026-34743: xz: XZ Utils: Denial of Service via buffer overflow in index decoding
Component: xz
Severity: Moderate
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-04-02T18:36:37.450000+00:00

A flaw was found in XZ Utils. When the `lzma_index_decoder()` function processes an empty index, and a subsequent `lzma_index_append()` operation is performed, insufficient memory is allocated. This can lead to a buffer overflow, potentially causing a denial of service (DoS) for affected systems.


Affected upstream versions: < 5.8.3
Fixed upstream versions: v5.8.3
Upstream repository: https://github.com/tukaani-project/xz
Upstream fix commit: c8c22869e780ff57c96b46939c3d79ff99395f87
CVE-2026-34756: vllm: vLLM: Denial of Service via excessively large 'n' parameter in OpenAI-compatible API
Component: vllm
Severity: Important
CWE: CWE-1284 (Improper Validation of Specified Quantity in Input)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-04-06T15:40:03.448000+00:00

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large 'n' parameter to the vLLM OpenAI-compatible API server. This can lead to a Denial of Service (DoS) by consuming excessive memory and blocking the system's event loop, causing the server to crash.


Affected upstream versions: >= 0.1.0, < 0.19.0
Fixed upstream versions: v0.19.0
Upstream repository: https://github.com/vllm-project/vllm
Upstream fix commit: b111f8a61f100fdca08706f41f29ef3548de7380
CVE-2026-34757: libpng: libpng: Information disclosure and data corruption via use-after-free vulnerability
Component: libpng
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Public date: 2026-04-09T14:41:18.195000+00:00

A flaw was found in libpng, a library used for handling PNG (Portable Network Graphics) image files. This vulnerability arises when an application reuses a pointer, previously obtained from functions like png_get_PLTE, by passing it back to a corresponding setter function within the same image structure. This action causes the setter to access memory that has already been deallocated, leading to a use-after-free condition. A local attacker could potentially exploit this flaw to corrupt image metadata or disclose sensitive information from the application's memory.

Statement: There's a use-after-free vulnerability in libpng. The flaw occurs when an application reuses a pointer from `png_get_PLTE`, `png_get_tRNS`, or `png_get_hIST` and passes it to a corresponding setter, leading to memory corruption or information disclosure. A local attacker could exploit this if a vulnerable application processes PNG files in this specific manner.
Red Hat Product Security team has rated this as having a moderate impact as the user needs to be tricked to open the maliciously crafted PNG image, additionally the attacker doesn't have full control if the content it's exfiltrating or corruption in the memory.

Affected upstream versions: >= 1.0.9, < 1.6.57
Fixed upstream versions: v1.6.57
Upstream repository: https://github.com/pnggroup/libpng
Upstream fix commit: 398cbe3df03f4e11bb031e07f416dfdde3684e8a
CVE-2026-3479: python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation
Component: python
Severity: Low
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Public date: 2026-03-18T18:13:42.288000+00:00

A flaw was found in Python's `pkgutil.get_data()` function, which is used to retrieve data from packages. This function did not properly validate the `resource` argument, allowing a local attacker to perform path traversal attacks. Path traversal enables an attacker to access files and directories stored outside the intended root directory, potentially leading to information disclosure or unintended file access.


Affected upstream versions: 3.14.0 < 3.14.4, 3.15.0a1 < 3.15.0a8
Fixed upstream versions: v3.15.0b1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: bcdf231946b1da8bdfbab4c05539bb0cc964a1c7
CVE-2026-34933: avahi: avahi-daemon: Avahi: Denial of Service via D-Bus method call
Component: avahi
Severity: Moderate
CWE: CWE-1288 (Improper Validation of Consistency within Input)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-04-03T22:43:26.683000+00:00

A flaw was found in Avahi. An unprivileged local user can exploit this vulnerability by sending a D-Bus method call with conflicting publish flags. This can lead to a denial of service (DoS) by crashing the avahi-daemon, making the service unavailable.


Affected upstream versions: < 0.9-rc4
Fixed upstream versions: v0.9-rc4
Upstream repository: https://github.com/avahi/avahi
Upstream fix commit: 625ca0fac19229f6dfa3a6c6b698ae657187e50c
CVE-2026-34982: vim: arbitrary command execution via modeline sandbox bypass
Component: vim
Severity: Important
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
CVSS v3: 8.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)
Public date: 2026-04-06T15:16:48.809000+00:00

A flaw was found in Vim. A modeline is used to set specific editor options directly from a text file. However, the `complete`, `guitabtooltip`, `printheader` options and the `mapset` function lack proper security checks, allowing an attacker to bypass restrictions and cause arbitrary OS command execution.

Statement: To exploit this vulnerability, an attacker needs to convince a user to open a specially crafted file. The arbitrary OS command execution is restricted to the privileges of the user running Vim, limiting the potential of a full system compromise.

Affected upstream versions: < 9.2.0276
Fixed upstream versions: v9.2.0276
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 75661a66a1db1e1f3f1245c615