Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-12735 — OS Command Injection in Neovim

CWE-78 — OS Command InjectionCWE-94 — Code Injection18 documents11 sources
Severity
8.6HIGHNVD
OSV9.8
EPSS
64.6%
top 1.54%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
8
NeovimVIMDebian Neovim+5 more
Timeline
PublishedJun 5
Latest updateJul 31

Description

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HExploitability: 1.8 | Impact: 6.0

Affected Packages11 packages

▶NVDneovim/neovim< 0.3.6
▶debiandebian/neovim< neovim 0.3.4-3 (bookworm)
▶Debianneovim/neovim< 0.3.4-3+3
▶NVDvim/vim< 8.1.1365
▶debiandebian/vim< neovim 0.3.4-3 (bookworm)

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-5x93-92vm-jw5m: getchar↗2022-05-24
▶
OSV
vim vulnerabilities↗2019-06-11
▶
OSV
CVE-2019-12735: getchar↗2019-06-05
▶

💥Exploits & PoCs

1
Exploit-DB
Vim < 8.1.1365 / Neovim < 0.3.6 - Arbitrary Code Execution↗2019-06-04
▶

📋Vendor Advisories

7
Ubuntu
Neovim vulnerability↗2021-03-15
▶
Palo Alto
PAN↗2020-04-08
▶
Microsoft
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline as demonstrated by execute in Vim and assert_fa↗2019-06-11
▶
Ubuntu
Vim vulnerabilities↗2019-06-11
▶
Ubuntu
Neovim vulnerability↗2019-06-11
▶

📄Research Papers

1
arXiv
Microservice Vulnerability Analysis: A Literature Review with Empirical Insights↗2024-07-31
▶

💬Community

5
Bugzilla
CVE-2019-12735 vim/neovim: ':source!' command allows arbitrary command execution via modelines↗2019-06-07
▶
Bugzilla
CVE-2019-12735 neovim: vim/neovim: the :source! command allows arbitrary command execution via the modeline [fedora-all]↗2019-06-07
▶
Bugzilla
CVE-2019-12735 neovim: vim/neovim: the :source! command allows arbitrary command execution via the modeline [epel-7]↗2019-06-07
▶
Bugzilla
CVE-2019-12735 neovim: vim/neovim: arbitrary command execution in getchar.c [fedora-all]↗2019-06-07
▶
Bugzilla
CVE-2019-12735 vim: vim/neovim: arbitrary command execution in getchar.c [fedora-all]↗2019-06-07
▶