CLSA-2026-1788182469
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1788182469.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1788182469
- Upstream
- Published
- 2026-08-31T13:21:21Z
- Modified
- 2026-10-26T09:32:02Z
- Summary
- Fix CVE(s): CVE-2026-73073
- Details
-
- SECURITY UPDATE: arbitrary Ex command execution during C omni-completion:
escaping only "/" and "\" in the typeref/typename tag field was not
enough. With no "/" in the payload an unclosed "[" makes :vimgrep's
pattern skipping fail, after which the command parser treats a following
"|" as a command separator, so a crafted tags entry still runs arbitrary
Ex/OS commands when C omni-completion is invoked on a hostile .c file.
- debian/patches/CVE-2026-73073.patch: match the type field literally with \V ... \m around escape(typename, '/') when building the :vimgrep pattern in s:StructMembers(), in runtime/autoload/ccomplete.vim; matches upstream patch 9.2.0845.
- CVE-2026-73073
- SECURITY UPDATE: arbitrary Ex command execution during C omni-completion:
escaping only "/" and "\" in the typeref/typename tag field was not
enough. With no "/" in the payload an unclosed "[" makes :vimgrep's
pattern skipping fail, after which the command parser treats a following
"|" as a command separator, so a crafted tags entry still runs arbitrary
Ex/OS commands when C omni-completion is invoked on a hostile .c file.
- References