CVE-2019-12735

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source!

published June 5, 2019

CVSS
—
EPSS
19%
Percentile
97.3
In the wild
Unconfirmed
What it is

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.18964 · 97.3th percentile
Published
2019-06-05T13:07Z
EPSS history
Timeline
  • 05 JUN 13:07Z
    getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source!
    cvelistv5