CLSA-2026-1789136288
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1789136288.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1789136288
- Upstream
CVE (2)
- Published
- 2026-09-11T14:18:18Z
- Modified
- 2026-10-26T09:43:18Z
- Summary
- Fix CVE(s): CVE-2026-73073
- Details
-
- SECURITY UPDATE: Arbitrary Ex command execution during C omni-completion: s:StructMembers() in runtime/autoload/ccomplete.vim interpolates a tags-file typeref/typename value into a :vimgrep pattern with only "/" and "" escaped, so an unclosed "[" makes vimgrep pattern skipping fail and a following "|" is then parsed as an Ex command separator, running the rest of the tag value as Ex commands
- debian/patches/CVE-2026-73073.patch: match the typename literally in s:StructMembers() by prefixing it with "\V" and restoring magic mode with "\m" for the trailing "(\t|$)" group, so no regex metacharacter in the tag field can affect :vimgrep pattern parsing; this completes CVE-2026-59858.patch (upstream 9.2.0735), whose escaping alone was insufficient; the upstream src/version.c bump and the new src/testdir/test_plugin_ccomplete.vim test are omitted as they do not apply to 8.1.0875
- CVE-2026-73073
- SECURITY UPDATE: Arbitrary Ex command execution during C omni-completion: s:StructMembers() in runtime/autoload/ccomplete.vim interpolates a tags-file typeref/typename value into a :vimgrep pattern with only "/" and "" escaped, so an unclosed "[" makes vimgrep pattern skipping fail and a following "|" is then parsed as an Ex command separator, running the rest of the tag value as Ex commands
- References