Data Loss Vulnerability in Vim Package Due to Malicious Zip Files
Summary
CVE-2025-29768: Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. Affects vim versions < 9.1.1202-r0. Fixed in 9.1.1202-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a highly configurable text editor used for efficiently creating and editing any kind of text. It is widely utilized by developers and system administrators for its powerful features and extensibility. However, certain versions of Vim prior to 9.1.1198 are vulnerable to a specific issue involving zip.vim, which can lead to potential data loss when handling specially crafted zip files.
Vulnerability Detail
The vulnerability, identified as CVE-2025-29768, arises when a user opens a malicious zip file with Vim and inadvertently triggers a data loss scenario by pressing 'x' on a strangely named file. This issue is classified as medium severity, as it requires user interaction to exploit, but it poses a risk of significant data loss if not addressed.
How To Fix
Minimum fixed version
9.1.1202-r0
This is the first release that contains the fix.
sudo apk add --upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid opening zip files with Vim until they have updated to the patched version. Additionally, users can check the contents of zip files using alternative tools that do not have this vulnerability.
Conclusion
The CVE-2025-29768 vulnerability in Vim poses a risk of data loss when handling malicious zip files. Users are strongly encouraged to update to version 9.1.1198 or later to mitigate this risk. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for vim →
FAQ
All versions of Vim prior to 9.1.1198 are affected by this vulnerability.
Opening a malicious zip file can lead to potential data loss if you press 'x' on a strangely named file.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
The best prevention is to update Vim to the latest version. Avoid opening suspicious zip files until the update is applied.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights.
Related vulnerabilities
Recent vulnerabilities recorded for vim.
