getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade vimUpgrade neovim | Jun 24, 2019 | Jun 5, 2019 |
| Amazon Linux Ami 2 | — | Upgrade vim-filesystemUpgrade vim-minimalUpgrade vim-enhancedUpgrade vim-debuginfoUpgrade vim-commonUpgrade vim-X11 | Apr 27, 2020 | Jun 5, 2019 |
| Amazon_linux | — | Upgrade vim | Jul 27, 2019 | Jun 5, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 5, 2019 |
| Centos_linux | — | Upgrade vim-common-debuginfoUpgrade vim-commonUpgrade vim-enhanced-debuginfoUpgrade vim-X11-debuginfoUpgrade vim-debugsourceUpgrade vim-minimal-debuginfoUpgrade vim-minimalUpgrade vim-X11Upgrade vim-filesystemUpgrade vim-enhancedUpgrade vim-debuginfo | Jul 3, 2019 | Jun 5, 2019 |
| Debian | — | Upgrade vimUpgrade neovim | Jun 19, 2019 | Jun 5, 2019 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jun 24, 2019 |
| Gentoo Linux | — | Upgrade app-editors/gvim.Upgrade app-editors/vim. | Mar 13, 2020 | Jun 5, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade vim-minimalUpgrade vim-filesystemUpgrade vim-enhancedUpgrade vim-common | Jul 23, 2019 | Jun 5, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade vim-enhancedUpgrade vim-minimalUpgrade vim-commonUpgrade vim-filesystem | Sep 25, 2019 | Jun 5, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade vim-enhancedUpgrade vim-minimalUpgrade vim-filesystemUpgrade vim-common | Jul 2, 2019 | Jun 5, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade vim-filesystemUpgrade vim-commonUpgrade vim-minimalUpgrade vim-enhanced | Jul 26, 2019 | Jun 5, 2019 |
| Oracle Solaris | — | Upgrade editor/vim to version 8.1.1561-11.4.12.0.1.2.0 on Solaris 11.4Upgrade editor/vim/vim-core to version 8.1.1561-11.4.12.0.1.2.0 on Solaris 11.4Upgrade editor/gvim to version 8.1.1561-11.4.12.0.1.2.0 on Solaris 11.4 | Aug 21, 2019 | Jun 5, 2019 |
| Oracle_linux | — | Upgrade vim-enhancedUpgrade vim-minimalUpgrade vim-filesystemUpgrade vim-X11Upgrade vim-common | Jun 27, 2019 | Jun 5, 2019 |
| Redhat_linux | — | Upgrade vim-minimalUpgrade vim-enhanced-debuginfoUpgrade vim-common-debuginfoUpgrade vim-X11-debuginfoUpgrade vim-minimal-debuginfoNo solution existsUpgrade vim-filesystemUpgrade vim-debuginfoUpgrade vim-enhancedUpgrade vim-commonUpgrade vim-debugsourceUpgrade vim-X11 | Jun 28, 2019 | Jun 5, 2019 |
| Suse | — | Upgrade vim-baseUpgrade neovimUpgrade neovim-langUpgrade vim-smallUpgrade vimUpgrade vim-data-commonUpgrade vim-dataUpgrade gvim | Jun 12, 2019 | Jun 5, 2019 |
| Ubuntu | — | Upgrade vim-commonUpgrade neovim-runtimeUpgrade neovim-runtime (Ubuntu Pro)Upgrade vim-gui-commonUpgrade vim-runtimeUpgrade neovim (Ubuntu Pro)Upgrade neovimUpgrade vim | Jun 12, 2019 | Jun 5, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 5, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub