- Description
- Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
- Products
- vim
CVSS 3.1
- Type
- Secondary
- Base score
- 8.2
- Impact score
- 5.8
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
- Severity
- HIGH
- security-advisories@github.com
- CWE-78
- Hype score
- Not currently trending
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B64DB9F0-F10B-40FA-A094-9178E5991FFF",
"versionEndExcluding": "9.2.0276",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]