CVE-2025-27423

HIGH EPSS 97.2%
Published Mar 3, 20251y ago · Modified Jun 17, 20262w ago
7.1 CVSS 3.1
High
Find Similar
Published Mar 3, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164

CVSS Details

Base Score
7.1
Exploitability
1.8
Impact
5.2
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
97.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-77 Command Injection Injection

Affected Products 2

VendorProductVersionRange
vimvim*≥9.1.0858  –  <9.1.1164
netapphci_compute_node*any

References 4

  • github.com https://github.com/vim/vim/commit/129a8446d23cd9cb4445fcfea259cba5e0487d29
    Patch
  • github.com https://github.com/vim/vim/commit/334a13bff78aa0ad206bc436885f63e3a0bab399
    Patch
  • github.com https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3
    Vendor Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20250502-0002/
    Third Party Advisory

Remediation

  • github.com https://github.com/vim/vim/commit/129a8446d23cd9cb4445fcfea259cba5e0487d29
    Patch
  • github.com https://github.com/vim/vim/commit/334a13bff78aa0ad206bc436885f63e3a0bab399
    Patch