Vim Tar Plugin Code Execution Vulnerability

A code execution vulnerability has been identified in Vim versions prior to 9.1.1164, specifically within the tar.vim plugin. This plugin, which facilitates the editing and viewing of tar files, has a flaw that allows shell commands to be executed via specially crafted tar archives. The vulnerability arises because the plugin appends file names directly from the tar archive to the command line without proper sanitization. Exploitation depends on the user's shell environment.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution.

Reproduction

To reproduce this vulnerability, a tar file must be created with a file name that includes a command to be executed. This tar file should then be opened in Vim using the tar.vim plugin. The plugin will read the file names from the tar archive and execute any embedded commands, taking advantage of the lack of input validation.

Remediation

Users can update to Vim version 9.1.1164 or later, where this vulnerability has been fixed.