134 results · Clear filters · Feed
-
High 7.8
Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution
A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell comma…
-
High 7.1
Vim: Arbitrary Ex Command Execution in C Omni-Completion
Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an untermina…
-
High 8.6
Vim: Arbitrary Code Execution via Netrw Menu Construction
Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled dire…
-
High 8.4
Vim: Arbitrary Code Execution via Shell Keyword Lookup
Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without…
-
High 8.4
Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`
Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes …
-
High 7.1
Vim: Heap Buffer Overflow in Text Property Handling
Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-proper…
-
High 8.5CVE-2026-73072 Public exploit
Vim: Heap Buffer Overflow when Loading a Spell File
Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes und…
-
High 8.4
Vim: Arbitrary Code Execution via PHP Omni-Completion
Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via wi…
-
High 8.4
Vim: Arbitrary Code Execution via C Omni-Completion
Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run th…
-
High 8.4
Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings
Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec()…
-
High 7.5
Vim: Arbitrary Code Execution via Python Omni-Completion
Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluate…
-
High 7.3
Vim: Arbitrary Code Execution via Python Omni-Completion
Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) exec…
-
High 7.3
Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name
Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths …
-
High 8.2
Vim modeline bypass via various options affects Vim < 9.2.0276
Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_M…
-
High 7.1CVE-2025-27423 EPSS 22%
Improper Input Validation in Vim
Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append …
-
High 7.8
Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the er…
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to v9.0.2010.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873.
-
High 7.3
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.1840.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.1857.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.1858.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.
-
High 7.8
Integer Overflow or Wraparound in vim/vim
Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846.
-
High 7.8
A divide by zero issue existed in vim of OpenCloudOS Stream
Divide By Zero in vim/vim from 9.0.1367-1 to 9.0.1367-3
-
High 7.8
Integer Overflow or Wraparound in vim/vim
Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.
-
High 7.8
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.
-
High 8.4
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402.
-
High 7.3
Incorrect Calculation of Buffer Size in vim/vim
Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.
-
High 7.3
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.
-
High 7.3
Divide By Zero in vim/vim
Divide By Zero in GitHub repository vim/vim prior to 9.0.1367.
-
High 7.3
Divide By Zero in vim/vim
Divide By Zero in GitHub repository vim/vim prior to 9.0.1247.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.
-
High 7.8
A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thr…
-
High 7.3
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.
-
High 7.3
Out-of-bounds Write in vim/vim
Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.
-
High 7.3
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
-
High 7.3
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0882.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765.