A local attacker with access to the same shared directory can pre-create a FIFO named 'vifm-ipc-vifm'. When a victim user launches Vifm, the application connects to this attacker-controlled pipe. The attacker can then inject IPC packets containing the '-c' flag and '!shell' commands, which are subsequently executed by the Vifm process under the victim's security context. This allows an attacker to escalate privileges to match the victim user's session, which is particularly critical if a more privileged user or administrator executes Vifm in a directory where a lower-privileged user has created the malicious pipe.

Impact

Successful exploitation allows a local attacker to execute arbitrary commands with the privileges of any user who subsequently launches the vulnerable version of Vifm. This can lead to full account takeover or unauthorized access to the victim's files and environment. The impact is significant for multi-user Linux or macOS systems where Vifm is used by administrative personnel.

Recommendation

1. Upgrade Vifm to a patched version once released by the maintainers; monitor the Vifm project repositories for the official fix.
2. Implement local monitoring for the creation of FIFO files in world-writable directories like '/tmp' or '/var/tmp' that match the naming pattern 'vifm-ipc-vifm'.
3. Restrict write access to shared temporary directories where possible or enforce the use of private temporary directories for individual users to prevent malicious pipe pre-creation.