[Security] MacVim affected by GHSA-cwgx-gcj7-6qh8 — command injection via backtick expansion in tag filenames (vim < 9.2.0357)

Summary

MacVim's src/tag.c expands backtick expressions in tag file tagname fields when processing wildcard patterns. A malicious tags file containing a backtick expression like `touch /tmp/pwned` as a filename causes arbitrary shell command execution when a user issues a :tag command. The fix from vim 9.2.0357 (c78194e4) has not been applied to macvim r183.

Vulnerability Details

• GHSA: GHSA-cwgx-gcj7-6qh8
• CVE: CVE-2026-41411
• Upstream fix (vim): 9.2.0357 (commit c78194e4ee65bab5fef3b4f8de8f4e6ee47fbaa6, 2026-04-15)
• Affected code: src/tag.c line 4141
• Vulnerability type: CWE-78 — OS Command Injection

Root Cause

In src/tag.c, when a tag filename matches as a wildcard pattern, the filename is expanded — which includes backtick expansion (shell command substitution):

/* src/tag.c line 4141 (macvim r183) */
if (expand && mch_has_wildcard(fname))

Since backtick expressions (e.g., `cmd`) satisfy mch_has_wildcard(), they are expanded via the shell. A malicious tags file containing:

main	`touch /tmp/pwned`	/^int main/;"	f

causes touch /tmp/pwned to execute when the user runs :tag main.

Attack Scenario

1. Attacker provides a malicious tags file in the project (e.g., via repository or build system)
2. Victim opens a file in MacVim with set tags=Xtags pointing to the malicious file
3. Victim issues :tag main or another tag navigation command
4. MacVim expands the backtick expression and executes arbitrary shell commands

Verification

$ grep -n 'mch_has_wildcard.*fname' src/tag.c
4141:    if (expand && mch_has_wildcard(fname))

Missing the guard && vim_strchr(fname, '\') == NULL`. Patch 9.2.0357 not present:

$ git log --all --oneline | grep -i '9.2.0357\|backtick.*tag\|cwgx'
(no output)

Suggested Fix

Merge vim patches up to at least 9.2.0357. The fix adds a backtick exclusion:

/* Fixed (vim 9.2.0357): disallow backticks, they could execute arbitrary shell commands */
if (expand && mch_has_wildcard(fname) && vim_strchr(fname, '`') == NULL)

References

• GHSA: https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8
• Upstream fix: https://github.com/vim/vim/commit/c78194e4ee65bab5fef3b4f8de8f4e6ee47fbaa6

Lisez src/tag.c autour de la ligne 4141 et comparez-le avec le commit c78194e4 de Vim 9.2.0357. Vérifiez que la gestion des tags ne développe plus les noms de fichiers contenant des backticks, tout en préservant la navigation habituelle des tags avec des caractères génériques ; l’issue ne fournit aucun test de régression nommé, examinez donc les tests de tags existants pour la validation.