Skip to main content

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVE-2025-27423

High
7.1/10

Summary

The package vim is an open-source, command-line text editor. It is distributed with the "tar.vim" plugin, which allows easy editing and viewing of both compressed and uncompressed tar files. The "tar.vim" plugin uses the ":read" ex command to append content below the cursor position. However, the content is not sanitized and is taken literally from the tar archive. This behavior can potentially allow the execution of shell commands via specially crafted tar archives. Whether this occurs depends on the shell being used (the "shell" option, which is set using "$SHELL"). The issue affects vim versions 9.1.0858 through 9.1.1163.

  • LOW
  • LOCAL
  • HIGH
  • UNCHANGED
  • REQUIRED
  • NONE
  • HIGH
  • NONE

CWE-77 - Command Injection

A command injection attack involves injecting an operating system command through the data input, which gets executed on the host operating system with the privileges of the victimized application. The impact of a command injection attack may range from loss of data confidentiality and integrity to unauthorized remote access to the hosting system. The attack may cause serious data breaches and system takeover.

References

Advisory Timeline

  • Published