Vim R Markdown highlighting allows command execution on Unix

Vim releases before 9.2.1178 can execute arbitrary shell commands on Unix-like systems when a user opens a crafted R Markdown or Quarto file with syntax highlighting enabled.

The R Markdown syntax support gathers language names from fenced code chunks and uses them to locate matching syntax files. Filtering meant to strip unsafe characters from those names could stop early on a crafted byte sequence, so untrusted text reached path expansion. On Unix that expansion is handled by the shell, turning a malicious chunk label into command execution in the Vim user's context.

Affected file types include .rmd, .smd, .qmd and similar. Windows is not exposed the same way because path expansion there does not invoke the shell. Exploitation still requires the victim to open the file, so the issue is rated medium severity. A CVE has been requested but is not yet assigned.

The flaw was reported and analyzed by GitHub user tylerni7-ant. It is fixed in Vim 9.2.1178. Users who open untrusted Markdown-with-code notebooks should upgrade.