// For flags

CVE-2019-12735

Vim < 8.1.1365 / Neovim < 0.3.6 - Arbitrary Code Execution

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

5
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.

El archivo getchar.c en Vim anterior a versión 8.1.1365 y Neovim anterior a versión 0.3.6 permite a los atacantes remotos ejecutar comandos arbitrarios del sistema operativo por medio de: comando source! en el componente modeline, como es demostrado por la ejecución en Vim, y assert_fails o nvim_input en Neovim.

It was found that the `:source!` command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text file in vim could result in arbitrary command execution.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-06-04 First Exploit
  • 2019-06-05 CVE Reserved
  • 2019-06-05 CVE Published
  • 2024-05-29 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
References (34)
URL Tag Source
http://www.securityfocus.com/bid/108724 Vdb Entry
https://bugs.debian.org/930020 Mailing List
https://bugs.debian.org/930024 Mailing List
https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html Mailing List
https://seclists.org/bugtraq/2019/Jul/39 Mailing List
https://seclists.org/bugtraq/2019/Jun/33 Mailing List
https://support.f5.com/csp/article/K93144355 X_refsource_confirm
https://support.f5.com/csp/article/K93144355?utm_source=f5support&amp%3Butm_medium=RSS X_refsource_confirm
URL Date SRC
https://www.exploit-db.com/exploits/46973 2019-06-04
https://github.com/oldthree3/CVE-2019-12735-VIM-NEOVIM 2019-06-19
https://github.com/st9007a/CVE-2019-12735 2022-07-26
https://github.com/datntsec/CVE-2019-12735 2020-10-27
https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md 2024-08-04
URL Date SRC
https://github.com/neovim/neovim/pull/10082 2023-11-07
https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040 2023-11-07
URL Date SRC
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00031.html 2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00036.html 2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00037.html 2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00034.html 2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00050.html 2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00075.html 2023-11-07
https://access.redhat.com/errata/RHSA-2019:1619 2023-11-07
https://access.redhat.com/errata/RHSA-2019:1774 2023-11-07
https://access.redhat.com/errata/RHSA-2019:1793 2023-11-07
https://access.redhat.com/errata/RHSA-2019:1947 2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BMDSHTF754TITC6AQJPCS5IRIDMMIM7 2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRIRBC2YRGKPAWVRMZS4SZTGGCVRVZPR 2023-11-07
https://security.gentoo.org/glsa/202003-04 2023-11-07
https://usn.ubuntu.com/4016-1 2023-11-07
https://usn.ubuntu.com/4016-2 2023-11-07
https://www.debian.org/security/2019/dsa-4467 2023-11-07
https://www.debian.org/security/2019/dsa-4487 2023-11-07
https://access.redhat.com/security/cve/CVE-2019-12735 2019-07-30
https://bugzilla.redhat.com/show_bug.cgi?id=1718308 2019-07-30
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Vim
Search vendor "Vim"
 Vim
Search vendor "Vim" for product "Vim"
 < 8.1.1365
Search vendor "Vim" for product "Vim" and version " < 8.1.1365"
-
Affected
Neovim
Search vendor "Neovim"
 Neovim
Search vendor "Neovim" for product "Neovim"
 < 0.3.6
Search vendor "Neovim" for product "Neovim" and version " < 0.3.6"
-
Affected