[Security] MacVim affected by GHSA-cwgx-gcj7-6qh8 — command injection via backtick expansion in tag filenames (vim < 9.2.0357)

Summary

MacVim's src/tag.c expands backtick expressions in tag file tagname fields when processing wildcard patterns. A malicious tags file containing a backtick expression like `touch /tmp/pwned` as a filename causes arbitrary shell command execution when a user issues a :tag command. The fix from vim 9.2.0357 (c78194e4) has not been applied to macvim r183.

Vulnerability Details

• GHSA: GHSA-cwgx-gcj7-6qh8
• CVE: CVE-2026-41411
• Upstream fix (vim): 9.2.0357 (commit c78194e4ee65bab5fef3b4f8de8f4e6ee47fbaa6, 2026-04-15)
• Affected code: src/tag.c line 4141
• Vulnerability type: CWE-78 — OS Command Injection

Root Cause

In src/tag.c, when a tag filename matches as a wildcard pattern, the filename is expanded — which includes backtick expansion (shell command substitution):

/* src/tag.c line 4141 (macvim r183) */
if (expand && mch_has_wildcard(fname))

Since backtick expressions (e.g., `cmd`) satisfy mch_has_wildcard(), they are expanded via the shell. A malicious tags file containing:

main	`touch /tmp/pwned`	/^int main/;"	f

causes touch /tmp/pwned to execute when the user runs :tag main.

Attack Scenario

1. Attacker provides a malicious tags file in the project (e.g., via repository or build system)
2. Victim opens a file in MacVim with set tags=Xtags pointing to the malicious file
3. Victim issues :tag main or another tag navigation command
4. MacVim expands the backtick expression and executes arbitrary shell commands

Verification

$ grep -n 'mch_has_wildcard.*fname' src/tag.c
4141:    if (expand && mch_has_wildcard(fname))

Missing the guard && vim_strchr(fname, '\') == NULL`. Patch 9.2.0357 not present:

$ git log --all --oneline | grep -i '9.2.0357\|backtick.*tag\|cwgx'
(no output)

Suggested Fix

Merge vim patches up to at least 9.2.0357. The fix adds a backtick exclusion:

/* Fixed (vim 9.2.0357): disallow backticks, they could execute arbitrary shell commands */
if (expand && mch_has_wildcard(fname) && vim_strchr(fname, '`') == NULL)

References

• GHSA: https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8
• Upstream fix: https://github.com/vim/vim/commit/c78194e4ee65bab5fef3b4f8de8f4e6ee47fbaa6

Đọc src/tag.c quanh dòng 4141 và so sánh với commit c78194e4 của Vim 9.2.0357. Xác minh rằng việc xử lý tag không còn mở rộng các tên tệp chứa backtick, đồng thời vẫn giữ nguyên việc điều hướng tag bằng wildcard thông thường; issue không cung cấp bài kiểm thử hồi quy có tên, vì vậy hãy kiểm tra các bài kiểm thử tag hiện có để xác thực.