Vim before 9.2.1201: Ex command execution via Cargo Quickfix hooks
Medium-severity security advisory: improper neutralization in Vim's Rust support may allow execution of Ex commands through Cargo Quickfix hooks. A CVE has been requested but not yet assigned.
According to the advisory published on the oss-sec mailing list on 15 October 2026 by the project maintainer, Vim versions earlier than 9.2.1201 are affected by improper neutralization of elements in a command. The issue lies in the Rust support, in the file runtime/autoload/cargo/quickfix.vim, which changes the working directory while handling Cargo Quickfix hooks. This may allow execution of Ex commands.
The advisory rates severity as medium and lists CWE-77 and CWE-78. A CVE identifier has been requested but was not yet assigned at publication. The text available for this record is truncated, so details such as exploitation conditions and mitigations should be checked in the original advisory.
Relevance to Rota Nacional is indirect. The platform does not patch or protect local editors or tools and does not resolve the flaw. For anyone using AI to study the advisory or plan the update, do not paste internal configurations, network paths, private repositories or credentials into prompts. Automatic personal data detection helps in some cases, but it does not replace manual removal of secrets before sending.