CLSA-2026-1784799711
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1784799711.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1784799711
- Upstream
- Published
- 2026-07-23T09:42:17Z
- Modified
- 2026-10-26T09:31:47Z
- Summary
- Fix CVE(s): CVE-2026-59858
- Details
-
- SECURITY UPDATE: arbitrary Ex command execution during C omni-completion:
the C omni-completion script interpolated the typeref/typename tag field
of a tags entry, without escaping, into a :vimgrep pattern run through
:execute. Because :vimgrep honours the bar as a command separator, a
crafted tag field could close the search pattern and append an arbitrary
Ex command, which ran when C omni-completion was invoked on a hostile .c
file whose project tags file carried such an entry.
- debian/patches/CVE-2026-59858.patch: escape the type field with escape(typename, '/') before building the :vimgrep pattern in s:StructMembers(), in runtime/autoload/ccomplete.vim; matches upstream patch 9.2.0735.
- CVE-2026-59858
- SECURITY UPDATE: arbitrary Ex command execution during C omni-completion:
the C omni-completion script interpolated the typeref/typename tag field
of a tags entry, without escaping, into a :vimgrep pattern run through
:execute. Because :vimgrep honours the bar as a command separator, a
crafted tag field could close the search pattern and append an arbitrary
Ex command, which ran when C omni-completion was invoked on a hostile .c
file whose project tags file carried such an entry.
- References