[Security] MacVim affected by GHSA-hwg5-3cxw-wvvg — OS command injection via backticks in 'path' option completion (vim < 9.2.0435)

Summary

MacVim's src/findfile.c and src/optiondefs.h allow backtick expressions in the 'path' option to be executed when file completion is triggered. Since 'path' can be set via modelines, an attacker can embed a malicious backtick command in a project file that executes when the victim uses file-path completion. The fix from vim 9.2.0435 (190cb3c2) has not been applied to macvim r183.

Vulnerability Details

• GHSA: GHSA-hwg5-3cxw-wvvg
• CVE: CVE-2026-44656
• Upstream fix (vim): 9.2.0435 (commit 190cb3c2b6e53290735f2c5cab1a06f703a90e69, 2026-05-03)
• Affected code: src/findfile.c + src/optiondefs.h ('path' option)
• Vulnerability type: CWE-78 — OS Command Injection

Root Cause

The 'path' option is not marked P_SECURE in src/optiondefs.h, so it can be set via modelines:

/* src/optiondefs.h line 2067 (macvim r183) */
{"path",    "pa",   P_STRING|P_EXPAND|P_VI_DEF|P_COMMA|P_NODUP,

Missing P_SECURE allows a modeline to set path+=\cmd`. In src/findfile.c, when file completion is performed for 'path'entries, backtick expressions are expanded via the shell — executingcmd`.

Attack Scenario

1. Attacker places a project file with a modeline:

   // vim: set path+=`id>/tmp/pwned` :
   

2. Victim opens the file in MacVim with modeline support enabled (default)
3. MacVim sets path to include the backtick expression
4. When the victim presses Tab for :find completion, MacVim expands the backtick and executes id>/tmp/pwned

Verification

$ grep -n '"path".*P_STRING' src/optiondefs.h
2067:    {"path",    "pa",   P_STRING|P_EXPAND|P_VI_DEF|P_COMMA|P_NODUP,

Missing P_SECURE. Also missing the backtick check in findfile.c. Patch 9.2.0435 not present:

$ git log --all --oneline | grep -i '9.2.0435\|path.*backtick\|hwg5'
(no output)

Suggested Fix

Merge vim patches up to at least 9.2.0435. The fix:

1. Adds P_SECURE to 'path' in optiondefs.h:

   {"path",    "pa",   P_STRING|P_EXPAND|P_VI_DEF|P_SECURE|P_COMMA|P_NODUP,
   

2. Adds a backtick guard in findfile.c:

   /* do not expand backticks, could have been set via a modeline */
   if (vim_strchr(buf, '`') != NULL)
       continue;
   

References

• GHSA: https://github.com/vim/vim/security/advisories/GHSA-hwg5-3cxw-wvvg
• Upstream fix: https://github.com/vim/vim/commit/190cb3c2b6e53290735f2c5cab1a06f703a90e69

Bắt đầu với src/optiondefs.h và src/findfile.c, sau đó so sánh các thay đổi còn thiếu với commit 190cb3c2 của Vim hoặc phiên bản 9.2.0435. Xác minh rằng tùy chọn 'path' và cách xử lý backtick khớp với bản sửa lỗi upstream, đồng thời sử dụng các kiểm tra grep và kịch bản tấn công của issue để xác nhận rằng lỗ hổng đã được khắc phục.