Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164

An update of the vim package has been released.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages
    using the `:redir` ex command to register, variables and files. It also allows to show the contents of
    registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a
    register, Vim will free the register content before storing the new content in the register. Now when
    redirecting the `:display` command to a register that is being displayed, Vim will free the content while
    shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the
    ex_display() function, that it does not try to redirect to a register while displaying this register at
    the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers
    (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will
    fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero
    when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no
    known workarounds for this vulnerability. (CVE-2025-26603)

  - Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows
    easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim
    plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized
    and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar
    archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using
    $SHELL). The issue has been fixed as of Vim patch v9.1.1164 (CVE-2025-27423)

The version of vim installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-27423 advisory.

  - Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows     easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim     plugin uses the :read ex command line to append below the cursor position, however the is not sanitized     and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar     archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using     $SHELL). The issue has been fixed as of Vim patch v9.1.1164 (CVE-2025-27423)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of vim installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-27423 advisory.

  - Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows     easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim     plugin uses the :read ex command line to append below the cursor position, however the is not sanitized     and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar     archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using     $SHELL). The issue has been fixed as of Vim patch v9.1.1164 (CVE-2025-27423)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 2ec7816d-fdb7-11ef-91ff-b42e991fc52e advisory.

    security-advisories@github.com reports:
    Vim is distributed with the tar.vim plugin, that allows               easy editing and viewing of (compressed or uncompressed) tar               files.  Starting with 9.1.0858, the tar.vim plugin uses the               :read ex command line to append below the               cursor position, however the is not sanitized and is taken               literally from the tar archive.  This allows to execute               shellcommands via special crafted tar archives. Whether               this really happens, depends on the shell being used               ('shell' option, which is set using $SHELL).


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-6452f3da4b advisory.

    The newest upstream commit

    Security fix for CVE-2025-27423

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-027a373c31 advisory.

    The newest upstream commit

    Security fix for CVE-2025-27423

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
240516	Photon OS 5.0: Vim PHSA-2025-5.0-0538	Nessus	PhotonOS Local Security Checks	high
427815	Alpine: gvim, multiple vim packages, xxd: security update to 9.1.1164-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
427815	Alpine: gvim, multiple vim packages, xxd: security update to 9.1.1164-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
233148	Azure Linux 3.0 Security Update: vim (CVE-2025-27423)	Nessus	Azure Linux Local Security Checks	high
232572	CBL Mariner 2.0 Security Update: vim (CVE-2025-27423)	Nessus	MarinerOS Local Security Checks	high
232562	FreeBSD : vim -- Improper Input Validation in Vim (2ec7816d-fdb7-11ef-91ff-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	high
232526	Fedora 40 : vim (2025-6452f3da4b)	Nessus	Fedora Local Security Checks	high
232206	Fedora 41 : vim (2025-027a373c31)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2025-27423

high

Tenable Plugins

high

high

high

high

high

high

high

high