getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.

References[email protected]/message/2BMDSHTF754TITC6AQJPCS5IRIDMMIM7/[email protected]/message/TRIRBC2YRGKPAWVRMZS4SZTGGCVRVZPR/


Source: MITRE

Published: 2019-06-05

Updated: 2019-06-13

Type: CWE-78

Risk Information

CVSS v2.0

Base Score: 9.3

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 8.6

Severity: HIGH

CVSS v3.0

Base Score: 8.6

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Impact Score: 6

Exploitability Score: 1.8

Severity: HIGH