60
CVE-2025-27423
massShell Command Injection in Vim tar.vim Plugin via Crafted Tar Archives
CVSS 3.1
7.1 high
EPSS
22%p98
Published
()
Modified
AI analysis
CVE-2025-27423 is a command injection flaw (CWE-77) in Vim's bundled tar.vim plugin, introduced in Vim 9.1.0858, where content taken literally from a tar archive is passed to the ':read' ex command without sanitization when the plugin appends below the cursor position. A user triggers it by opening or viewing a specially crafted (compressed or uncompressed) tar archive in an affected Vim build; whether crafted text is executed as shell commands depends on the configured 'shell' option ($SHELL). A successful attacker gains arbitrary shell command execution with the privileges of the user running Vim, yielding high confidentiality and integrity impact with no availability impact (CVSS 3.1: 7.1). Anyone running Vim 9.1.0858 or later before patch 9.1.1164 is affected, including Vim as shipped or consumed with NetApp HCI Compute Node per the listed product CPE. As of now there is no known public proof-of-concept and the issue is not in CISA KEV, but the elevated EPSS score of 22.5% (98th percentile) suggests a meaningful near-term exploitation likelihood, and a fix is available in Vim patch v9.1.1164.
What to do: Upgrade Vim to patch level 9.1.1164 or later, which fixes this issue. Until then, do not open untrusted or unfamiliar tar archives with the tar.vim plugin (e.g., via 'vim archive.tar'), and review the 'shell' option in Vim configurations since exploitation depends on which shell is used. NetApp HCI Compute Node customers should track and apply NetApp's published updates for this CVE.
Affected
| Vim | 9.1.0858 through versions before 9.1.1164 (fixed in patch v9.1.1164) |
| NetApp HCI Compute Node | — |
Estimated exposure
masson the order of hundreds of thousands to millions of Vim installations plausibly affected (Vim ships by default on virtually all Linux/macOS/Unix systems and… — Vim is preinstalled on essentially every Unix-like workstation, server and CI/CD environment, and the vulnerable band of recent 9.1.x builds is widely deployed by rolling releases and self-built installations; exact counts of installs…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164