vulnerability
Arch Linux: Arbitrary command execution (CVE-2016-1248)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:M/Au:N/C:P/I:P/A:P) | Nov 23, 2016 | Jul 11, 2025 | Nov 27, 2025 |
Severity
7
CVSS
(AV:N/AC:M/Au:N/C:P/I:P/A:P)
Published
Nov 23, 2016
Added
Jul 11, 2025
Modified
Nov 27, 2025
Description
A vulnerability has been discovered in vim which would allow arbitrary shell commands to be run if a user opened a file with a malicious modeline. This is due to lack of validation of values for a few options. Those options' values are then used in vim's scripts to build a command string that's evaluated by execute, which is what allows the shell commands to be run.
This has been fixed in Vim by patch 8.0.0056. Since Neovim shares this code, it is also vulnerable.
This has been fixed in Vim by patch 8.0.0056. Since Neovim shares this code, it is also vulnerable.
Solution
arch-linux-upgrade-latest
References
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.