[Security] MacVim affected by CVE-2026-46483 — tar#Vimuntar() command injection via shellescape (vim < 9.2.0479)

[Security] MacVim affected by CVE-2026-46483 — tar#Vimuntar() command injection via shellescape (vim < 9.2.0479)

Summary

MacVim bundles the vim source at version 9.2 (patches 1-332 in the current build), which is
below the patched version 9.2.0479 that fixes CVE-2026-46483.

Vulnerability Details

• Upstream CVE: CVE-2026-46483
• Inherited from: vim/vim
• Affected code: runtime/autoload/tar.vim, function tar#Vimuntar()
• Vulnerability type: CWE-78 — OS Command Injection
• Fixed in: vim 9.2.0479 (commit 3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1)

Root Cause

In tar#Vimuntar() (runtime/autoload/tar.vim), the function decompresses a .tgz tarball
using :!gunzip and tar. The filename is escaped using shellescape(tartail) without
the second argument 1:

" runtime/autoload/tar.vim (macvim r183, around line 815)
if tartail =~ '\.tgz'
   if executable("gunzip")
    silent exe "!gunzip ".shellescape(tartail)

When vim's :! command processes the command string, the ! character in the filename
is interpreted by vim's command-line history substitution BEFORE the shell sees it.
shellescape(x, 0) (the default) does not escape ! for the vim :! context, while
shellescape(x, 1) does.

If an attacker can name a .tgz file to contain !command, and trick a user into
running tar#Vimuntar() on it, the embedded command is executed.

Affected MacVim Code

MacVim's runtime/autoload/tar.vim contains the vulnerable tar#Vimuntar() function at
line 784. The fix changes shellescape(tartail) to shellescape(tartail, 1) throughout
the function.

Note: neovim does NOT have the tar#Vimuntar() function and is not affected by this
specific vulnerability.

Affected MacVim Version

MacVim r183 (vim 9.2 patches 1-332) — current HEAD as of 2026-05-18.

The fix commit 3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1 from vim/vim is not present
in the macvim-dev/macvim repository:

git log --all --oneline | grep 3fb5e58f  # returns no output

Suggested Fix

Merge or cherry-pick vim/vim patches up to at least 9.2.0479:

• Upstream fix: https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1

The fix changes shellescape(tartail) to shellescape(tartail, 1) which properly escapes
! characters for vim's :! command context.

References

• CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-46483
• Upstream advisory: https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w
• Upstream fix commit: https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1

Start with runtime/autoload/tar.vim and inspect tar#Vimuntar(), especially the .tgz handling around the affected line. Compare the function with Vim commit 3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1 and verify that MacVim includes the upstream fix through Vim 9.2.0479; done means the vulnerable function is updated and the change is covered by an appropriate verification.