* SECURITY UPDATE: command injection in the tar plugin: tar#Vimuntar() escaped the tarball name with shellescape() without the special argument before running gunzip/gzip through :!, so characters that Vim expands in a :! command line (such as % and #) survived in the name and let a crafted archive name run arbitrary shell commands. - debian/patches/CVE-2026-46483.patch: use the shellescape(name, 1) form for both :! invocations in runtime/autoload/tar.vim; matches upstream patch 9.2.0479. - CVE-2026-46483 * SECURITY UPDATE: code injection via netrw directory history: s:NetrwBookHistSave() serialised each history entry into ~/.vim/.netrwhist by wrapping the value in single quotes with string concatenation, so a directory name containing a single quote closed the literal and injected Vimscript that ran when the history file was sourced on the next netrw start. - debian/patches/CVE-2026-47162.patch: encode the value with string() in runtime/autoload/netrw.vim; matches upstream patch 9.2.0495. - CVE-2026-47162 * SECURITY UPDATE: code execution through Python omni-completion: pythoncomplete and python3complete rebuilt the buffer's Python code and passed it to exec(), including the import and from statements harvested from the buffer, so invoking omni-completion in a hostile Python file executed arbitrary module-level code. - debian/patches/CVE-2026-52858.patch: skip import/from statements unless g:pythoncomplete_allow_import is set, in both runtime/autoload/pythoncomplete.vim and python3complete.vim; matches upstream patches 9.2.0561 and 9.2.0568, the latter being required for the opt-in to take effect at all. - CVE-2026-52858 * SECURITY UPDATE: out-of-bounds access when a terminal buffer is snapshotted: the per-cell loop in move_terminal_to_buffer() walked cell.chars[] with no upper bound, and libvterm leaves that array unterminated when a cell uses all VTERM_MAX_CHARS_PER_CELL slots (a base character plus five combining marks), so it read past the array and appended the out-of-bounds values to a buffer sized for far fewer bytes. - debian/patches/CVE-2026-52859.patch: bound the loop with i < VTERM_MAX_CHARS_PER_CELL and size the buffer for six 6-byte characters, in src/terminal.c; matches upstream patch 9.2.0565 together with its prerequisite 8.1.0611, without which the bounded loop would still overrun the MB_MAXBYTES-sized buffer. - CVE-2026-52859 * SECURITY UPDATE: code execution through Python omni-completion definition headers: Scope.get_code() reproduced def and class headers verbatim in the source handed to exec(), and Python evaluates parameter default values, annotations and base-class expressions at definition time, so crafted headers ran arbitrary code during completion even with imports disabled. - debian/patches/CVE-2026-52860.patch: strip default values and annotations from parameters and accept only dotted names as base classes, in both runtime/autoload/pythoncomplete.vim and python3complete.vim; matches upstream patch 9.2.0597. - CVE-2026-52860 * SECURITY UPDATE: out-of-bounds write reading a crafted spell file: tree_count_words() and sug_filltree() descended the word trie without bounding the depth, so a deeply nested trie wrote past the ends of their MAXWLEN-sized arridx[], curi[] and wordcount[] arrays. - debian/patches/CVE-2026-55693.patch: only descend while depth < MAXWLEN - 1 in both trie walkers, in src/spellfile.c; matches upstream patch 9.2.0653. - CVE-2026-55693 * SECURITY UPDATE: code injection when netrw opens a remote file: s:NetrwBrowse() passed bufname() unescaped into an :execute'd "b" command, so a buffer name containing the Ex command separator ran arbitrary Ex commands. - debian/patches/CVE-2026-55895.patch: escape the name with fnameescape() in runtime/autoload/netrw.vim; matches the applicable hunk of upstream patch 9.2.0663. - CVE-2026-55895 * SECURITY UPDATE: out-of-bounds write in SOFO soundfolding: spell_soundfold_sofo() walked the input word without checking the index into its MAXWLEN-sized result buffer, so a crafted spell file with a long SOFO translation wrote past the end of it. - debian/patches/CVE-2026-57455.patch: add the ri < MAXWLEN - 1 abort condition to the translation loop, in src/spell.c; matches upstream patch 9.2.0698. - CVE-2026-57455 * SECURITY UPDATE: code execution via doc strings in Python omni-completion: get_code() wrapped the doc string harvested from the buffer in triple quotes, so a doc string containing a triple quote closed the literal and the remainder was executed as code during completion. - debian/patches/CVE-2026-57456.patch: quote doc strings with repr() at all three generation sites in both runtime/autoload/pythoncomplete.vim and python3complete.vim; matches upstream patch 9.2.0699. - CVE-2026-57456 * SECURITY UPDATE: arbitrary Ex command execution during C omni-completion: s:StructMembers() interpolated the typeref field of a tags entry into a :vimgrep pattern run through :execute, so a crafted tags file could close the pattern and append an Ex command that ran when C omni-completion was invoked on a hostile source file. - debian/patches/CVE-2026-59858.patch: escape the type field with escape(typename, '/\') before building the pattern, in runtime/autoload/ccomplete.vim; matches upstream patch 9.2.0735. - CVE-2026-59858 * SECURITY UPDATE: the escaping above is not sufficient on its own: an unclosed bracket in the typeref makes :vimgrep's pattern skipping fail, after which a bar in the tag value is again treated as a command separator and executed. - debian/patches/CVE-2026-73073.patch: match the field literally with \V ... \m instead of relying on escaping alone, in runtime/autoload/ccomplete.vim; matches upstream patch 9.2.0845. - CVE-2026-73073