Vim < 9.2.0202 Command Injection (GHSA-w5jw-f54h-x46c)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(303793);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/30");

  script_cve_id("CVE-2026-33412");
  script_xref(name:"IAVA", value:"2026-A-0278-S");

  script_name(english:"Vim < 9.2.0202 Command Injection (GHSA-w5jw-f54h-x46c)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Vim installed on the remote host is prior to 9.2.0202. It is, therefore, affected by a vulnerability
as referenced in the GHSA-w5jw-f54h-x46c advisory.

  - Vim is an open source, command line text editor. Prior to version 9.2.0202, Vim's glob() function on
    Unix-like systems, specifically the mch_expand_wildcards() function, constructs shell commands for
    wildcard expansion but fails to properly escape newline characters. An attacker can inject newlines in
    glob patterns to execute arbitrary shell commands, contingent on the user's shell configuration. This
    vulnerability is fixed in 9.2.0202. (CVE-2026-33412)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e641201f");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Vim version 9.2.0202 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-33412");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vim:vim");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("vim_nix_installed.nbin");
  script_require_keys("installed_sw/Vim");
  script_exclude_keys("Host/MacOSX/Version");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Vim', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
        { 'fixed_version' : '9.2.0202' }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);