[Security] MacVim affected by CVE-2026-41411 — tag file command injection (vim < 9.2.0357)

[Security] MacVim affected by CVE-2026-41411 — tag file command injection (vim < 9.2.0357)

Summary

MacVim bundles the vim source at version 9.2 (patches 1-332 in the current build), which is
below the patched version 9.2.0357 that fixes CVE-2026-41411.

Vulnerability Details

• Upstream CVE: CVE-2026-41411
• Inherited from: vim/vim
• Affected code: tag file processing (wildcard expansion of filename fields)
• Vulnerability type: CWE-78 — OS Command Injection
• Fixed in: vim 9.2.0357 (commit c78194e41d5a0b05b0ddf383b6679b1503f977fb)

Root Cause

Prior to vim 9.2.0357, when resolving a tag, the filename field from the tags file is passed
through wildcard expansion to resolve environment variables and wildcards. If a crafted tags
file contains a filename with shell metacharacters or backtick-enclosed commands, those
commands are executed when the tag is resolved.

An attacker who can influence the tags file (e.g., via a malicious project or downloaded
code repository) can achieve arbitrary command execution when the victim opens a file and
navigates to a tag definition.

Affected MacVim Version

MacVim r183 (vim 9.2 patches 1-332) — current HEAD as of 2026-05-18.

The fix commit c78194e41d5a0b05b0ddf383b6679b1503f977fb from vim/vim is not present
in the macvim-dev/macvim repository:

git log --all --oneline | grep c78194e  # returns no output

Suggested Fix

Merge or cherry-pick vim/vim patches up to at least 9.2.0357:

• Upstream fix: https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb

References

• CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-41411
• Upstream advisory: https://github.com/vim/vim/security/advisories/GHSA-7rvw-9w8x-xhwx
• Upstream fix commit: https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb

首先检查随附的 Vim 源代码及其历史记录，然后将仓库与上游提交 c78194e41d5a0b05b0ddf383b6679b1503f977fb 进行比较；issue 指出，git log 当前找不到匹配的提交。将随附的 Vim 补丁更新到至少 9.2.0357，并验证 MacVim 构建是否包含上游的 tag-file 安全修复。