Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-27423: Vim tar.vim plugin can run commands from crafted archives

CVE-2025-27423 · published 1 year ago

Summary

The tar.vim plugin in Vim version 9.1.0858 and later can read a tar archive and execute shell commands if the archive is specially crafted. This could let an attacker run code on the computer when a user opens a malicious tar file. Upgrade Vim to the version that includes patch 9.1.1164 or later to stop the problem.

What to do

Update alpine vim to version 9.1.1164-r0.
Update vim vim to version 9.1.1164 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	vim	vim	>= 9.1.0858, < 9.1.1164 `cpe:2.3:a:vim:vim::::::::`
–	netapp	hci_compute_node	All versions `cpe:2.3:h:netapp:hci_compute_node:-:::::::*`
Alpine:v3.22	alpine	vim	>= 9.1.0858, < 9.1.1164-r0 Fix: upgrade to 9.1.1164-r0
Alpine:v3.23	alpine	vim	>= 9.1.0858, < 9.1.1164-r0 Fix: upgrade to 9.1.1164-r0

Original advisory text

Improper Input Validation in Vim

Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164

References

https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3 Vendor Advisory
https://github.com/vim/vim/commit/129a8446d23cd9cb4445fcfea259cba5e0487d29 Patch
https://security.netapp.com/advisory/ntap-20250502-0002/ Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27423... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-27423 Vendor Advisory
https://security.alpinelinux.org/vuln/CVE-2025-27423 Vendor Advisory
https://github.com/vim/vim/commit/334a13bff78aa0ad206bc436885f63e3a0bab399 Patch

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.1 High

Exploitation

22% chance of attack within 30 days

Type

CWE-77Command Injection

Timeline

Published3 Mar 2025

Updated15 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-27423 · NVD

GHSA-wfmf-8626-q3r3 · GHSA

ALPINE-CVE-2025-27423 · OSV

CVE-2025-27423 · OSV

Track software like this

Free during beta