Cloudanix VulnDB

CVE-2025-27423

None

CVSS

—

EPSS

22.5%

Published

Mar 3, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A popular command-line text editor can be tricked into running attacker-chosen commands when someone opens a specially made archive file, giving outsiders control over the computer.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Remote Code Execution
Component
Application
Class
Command Injection
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unsanitized filenames from tar archives are passed literally to the :read ex command in the tar.vim plugin, enabling arbitrary shell command execution depending on the configured shell.

Why it matters to the business

Attackers can achieve code execution on developer or administrator systems that use Vim to inspect tar archives, increasing risk of malware deployment or credential theft across environments that rely on Vim.

How an attack unfolds

An attacker embeds shell metacharacters or commands inside filenames inside a tar archive; when a victim opens the archive with Vim, tar.vim invokes :read on the unsanitized filename, causing the shell to execute the embedded commands.

How to fix it

Upgrade Vim to a build containing commit 334a13bff78aa0ad206bc436885f63e3a0bab399 (equivalent to patch v9.1.1164) or later; rebuild from source or obtain updated packages from your distribution.

How to confirm the fix worked

Confirm the installed Vim reports a patch level at or above v9.1.1164; test by attempting to open a tar archive containing a filename with a harmless command and verify it is no longer executed.

Typical attack path

  1. Craft a tar archive containing filenames with shell command payloads
  2. Distribute the archive via email, download, or shared storage
  3. Victim opens the archive inside Vim, triggering tar.vim
  4. Vim executes the attacker-controlled :read command via the user's shell
  5. Payload runs with the privileges of the Vim process

How to detect it

Review process creation logs for child processes spawned by vim or gvim immediately after tar file access; correlate with file-open events involving .tar, .tgz, or .tar.gz extensions.

What your security team should do

  • Prioritize patching Vim across all developer workstations and servers within the next sprint
  • Configure Vim with set shell=/bin/false or a restricted shell for non-interactive use where feasible
  • Add tar files to the list of untrusted file types that trigger additional user warnings before opening
  • Monitor internal package repositories for updated Vim builds and push them via configuration management

The record

Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164

Affected packages

Ecosystem Package Introduced Fixed
Alpine:v3.22 vim 0 9.1.1164-r0
Debian:11 vim 0 No fix
Debian:12 vim 0 No fix
Debian:13 vim 0 No fix
Debian:14 vim 0 2:9.1.1230-1
Mageia:9 vim 0 9.1.1166-1.mga9
Ubuntu:20.04:LTS vim 0 No fix
Ubuntu:22.04:LTS vim 0 No fix
Ubuntu:24.04:LTS vim 0 No fix
Ubuntu:24.10 vim 0 No fix
Ubuntu:Pro:14.04:LTS vim 0 No fix
Ubuntu:Pro:16.04:LTS vim 0 No fix
Ubuntu:Pro:18.04:LTS vim 0 No fix

Related vulnerabilities