getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline as demonstrated by execute in Vim and assert_fails or nvim_input in Neovim.

🗓️ 25 Sep 2020 00:00:00Reported by MicrosoftType

Vim <8.1.1365 and Neovim <0.3.6 allow remote execution via modeline :source! with execute.

Reporter	Title	Published	Views	Family All 168
0day.today	Vim < 8.1.1365 / Neovim < 0.3.6 - Arbitrary Code Execution Vulnerability	7 Jun 201900:00	–	zdt
GithubExploit	Exploit for OS Command Injection in Vim	20 May 202107:18	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM Application Framework v1 (CentOS6) is End of Life	14 Dec 202120:35	–	ibm
IBM Security Bulletins	Security Bulletin: Remote Execution Vulnerability Affects Red Hat Linux Used By IBM WebSphere Application Server in IBM Cloud (CVE-2019-12735)	31 Jul 201919:44	–	ibm
IBM Security Bulletins	Security Bulletin: Vyatta 5600 vRouter Software Patches - Release 1801-za	25 Jul 201915:25	–	ibm
IBM Security Bulletins	Security Bulletin: Remote Execution Vulnerability Affects Red Hat Linux Used By IBM WebSphere Application Server for IBM Cloud Private VM Quickstarter (CVE-2019-12735)	22 Aug 201919:09	–	ibm
Tenable Nessus	Amazon Linux 2 : vim (ALAS-2019-1239)	12 Aug 201900:00	–	nessus
Tenable Nessus	Amazon Linux AMI : vim (ALAS-2019-1239)	26 Jul 201900:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0031: vim (ALINUX3-SA-2022:0031)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 7 : vim (CESA-2019:1619)	2 Jul 201900:00	–	nessus