Critical Vulnerability in Vim Package: Command Execution via Tar Plugin
Summary
ALPINE-CVE-2025-27423: Vim is an open source, command line text editor. Affects vim versions < 9.1.1164-r0. Fixed in 9.1.1164-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a widely-used open-source command line text editor known for its efficiency and versatility. It supports various plugins, including tar.vim, which facilitates the editing and viewing of tar files, both compressed and uncompressed. This functionality is essential for developers and system administrators who frequently work with archive files. However, a recent vulnerability has been identified in the tar.vim plugin, which could potentially allow malicious users to execute arbitrary shell commands.
Vulnerability Detail
The vulnerability arises from the tar.vim plugin in Vim versions starting from 9.1.0858. The plugin uses the ':read' ex command to append content from tar archives below the cursor position. However, the input from the tar archive is not properly sanitized, allowing crafted tar files to execute shell commands when opened. The risk is contingent on the shell being used, as determined by the 'shell' option set in the environment variable $SHELL. This could lead to severe security implications, including unauthorized access and system compromise.
How To Fix
Minimum fixed version
9.1.1164-r0
This is the first release that contains the fix.
sudo apk add --upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid opening tar files with Vim until they have updated to the patched version. Alternatively, consider using a different text editor that does not have this vulnerability.
Conclusion
The identified vulnerability in the Vim package poses a significant risk due to the potential for command execution via crafted tar files. Users are strongly advised to update to the latest patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities in open-source software.
See every vulnerability recorded for vim →
FAQ
The vulnerability allows for command execution through untrusted tar files due to improper sanitization of input in the tar.vim plugin.
If you are using Vim version 9.1.0858 or later, you are at risk. Check your version by running 'vim --version' in the terminal.
Exploitation of this vulnerability could lead to unauthorized command execution, potentially compromising the system's integrity and security.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check for vulnerabilities without installation at the Vulert playground.
If an immediate update is not possible, avoid using Vim to open tar files until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for vim.
