CVE-2019-12735: OS Command Injection
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assertfails or nviminput in Neovim.
Other sources
Vim before 8.1.1365 and Neovim before 0.3.6 did not restrict the :source! command when executed in a sandbox. This allows remote attackers to take advantage of the modeline feature to inject arbitrary commands when a specially crafted file is opened.
References: https://github.com/numirias/security/blob/master/doc/2019-06-04ace-vim-neovim.md
Upstream commits: vim: https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040 neovim: https://github.com/neovim/neovim/pull/10082/commits/5e611f32841e746932fbcbea292ca502ed9e694b
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/vimto a version that resolves this vulnerability.Fixed in 8.1.1365 - Upgrade
Upgrade
redhat/neovimto a version that resolves this vulnerability.Fixed in 0.3.6 - Upgrade
Upgrade
debian/neovimto a version that resolves this vulnerability.Fixed in 0.4.4-1Fixed in 0.7.2-7Fixed in 0.10.4-8Fixed in 0.12.3-4Fixed in 0.12.4-1 - Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:8.2.2434-3+deb11u1Fixed in 2:8.2.2434-3+deb11u3Fixed in 2:9.0.1378-2+deb12u2Fixed in 2:9.1.1230-2Fixed in 2:9.2.0524-1Fixed in 2:9.2.0782-1 - Upgrade
Upgrade
vimto a version that resolves this vulnerability.Fixed in 8.1.1365 - Upgrade
Upgrade
neovimto a version that resolves this vulnerability.Fixed in 0.3.6 - Compensating control
If you must open untrusted files, disable or avoid allowing modelines so crafted modelines cannot trigger :source! execution paths.
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12735?
CVE-2019-12735 has a critical severity rating due to its potential to allow remote command execution.
How do I fix CVE-2019-12735?
To fix CVE-2019-12735, upgrade Vim to version 8.1.1365 or later, or Neovim to version 0.3.6 or later.
Who is affected by CVE-2019-12735?
Users of Vim versions prior to 8.1.1365 and Neovim versions prior to 0.3.6 are affected by CVE-2019-12735.
What kind of attacks can exploit CVE-2019-12735?
CVE-2019-12735 allows remote attackers to execute arbitrary operating system commands via the :source! command in a modeline.
Is CVE-2019-12735 a known vulnerability?
Yes, CVE-2019-12735 is a known vulnerability that has been publicly disclosed and documented.