Preliminary research

Vim R Markdown: UTF-8 filter mismatch reaches shell-backed globbing

Christian Brabandt · Vim project / oss-security

AI-collected research leads through 16 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

An R Markdown syntax script filters code-fence language names with a regex that stops at an overlong UTF-8 NUL. The later globpath consumer passes surviving backtick syntax to the Unix shell, allowing command execution when a crafted supported file is opened with highlighting enabled.

Record

Researcher

Christian Brabandt

Published by

Vim project / oss-security

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Maintainer advisory

Tags

• parser-differential
• unicode
• command-injection
• rce
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Christian Brabandt, first published at the original source. Preserved copies are kept so the citation survives its host.