Vim < 9.1.1947 RCE

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(278086);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/23");

  script_cve_id("CVE-2025-66476");
  script_xref(name:"IAVA", value:"2025-A-0919-S");

  script_name(english:"Vim < 9.1.1947 RCE");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Vim installed on the remote host is prior to 9.1.1947. It is, therefore, affected by a vulnerability as
referenced in the GHSA-g77q-xrww-p834 advisory.

  - Prior to version 9.1.1947, an uncontrolled search path vulnerability on Windows allows Vim to execute malicious 
    executables placed in the current working directory for the current edited file. On Windows, when using cmd.exe
    as a shell, Vim resolves external commands by searching the current working directory before system paths. When 
    Vim invokes tools such as findstr for :grep, external commands or filters via :!, or compiler/:make commands, 
    it may inadvertently run a malicious executable present in the same directory as the file being edited. 
    The issue affects Vim for Windows prior to version 9.1.1947. (CVE-2025-66476)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/vim/vim/security/advisories/GHSA-g77q-xrww-p834");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Vim version 9.1.1947 or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-66476");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vim:vim");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("vim_win_installed.nbin");
  script_require_keys("installed_sw/Vim", "SMB/Registry/Enumerated");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [{'scope': 'target', 'match': {'os': 'windows'}}],
  'checks': [
    {
      'product': {'name': 'Vim', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'fixed_version' : '9.1.1947' }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);