Command Execution Vulnerability in Vim's tar.vim Plugin
Summary
CVE-2025-27423: Vim is an open source, command line text editor. Affects vim versions < 9.1.1164-r0. Fixed in 9.1.1164-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a highly configurable text editor built to enable efficient text editing. It is widely used by developers and system administrators for its powerful features and extensibility. The tar.vim plugin allows users to easily edit and view tar files, which can be compressed or uncompressed. However, a recent vulnerability has been identified in this plugin that could allow malicious users to execute shell commands through specially crafted tar archives.
Vulnerability Detail
The vulnerability, identified as CVE-2025-27423, arises from the tar.vim plugin's use of the ':read' ex command line to append content below the cursor position. This command does not properly sanitize input taken from tar archives, allowing for the execution of arbitrary shell commands depending on the user's shell configuration. The risk is contingent on the shell being used, which is determined by the 'shell' option set in the user's environment. This could lead to severe security implications if an attacker can manipulate tar files that are processed by Vim.
How To Fix
Minimum fixed version
9.1.1164-r0
This is the first release that contains the fix.
sudo apk add --upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the tar.vim plugin or refrain from processing untrusted tar files until the update is applied. Additionally, users can consider changing their shell settings to a more secure option until the vulnerability is resolved.
Conclusion
The CVE-2025-27423 vulnerability in Vim's tar.vim plugin poses a significant risk by allowing the execution of arbitrary shell commands through untrusted tar files. Users are urged to update their Vim installations to the patched version to ensure their systems remain secure. Until then, it is advisable to avoid using the affected plugin and to monitor for vulnerabilities using tools like Vulert.
See every vulnerability recorded for vim →
FAQ
CVE-2025-27423 is a vulnerability in the Vim text editor's tar.vim plugin that allows for the execution of arbitrary shell commands through untrusted tar files.
You can check your Vim version by running 'vim --version' in your terminal. If your version is below 9.1.1164, it is affected by this vulnerability.
If you cannot update Vim right away, avoid using the tar.vim plugin and refrain from opening untrusted tar files to mitigate the risk.
Yes, you can use tools like Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file.
More information can be found on the official CVE database or through the provided vulnerability report links.
Related vulnerabilities
Recent vulnerabilities recorded for vim.
