Data Loss Risk in Vim Due to Vulnerability in Zip Handling
Summary
DEBIAN-CVE-2025-29768: Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. Affects vim versions < 2:9.1.1230-1. Fixed in 2:9.1.1230-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a highly configurable text editor used for efficiently creating and editing any kind of text. It is known for its powerful features, including syntax highlighting, multi-level undo, and extensive plugin support. However, certain versions of Vim are vulnerable to potential data loss when handling specially crafted zip files, particularly when using the zip.vim plugin.
Vulnerability Detail
The vulnerability arises from the way Vim processes zip files, specifically in versions prior to 9.1.1198. If a user opens a specially crafted zip file and interacts with it by pressing 'x', there is a risk of data loss. This issue is classified as medium severity since it requires user interaction to exploit. The vulnerability has been addressed in Vim patch v9.1.1198, which mitigates the risk associated with this flaw.
How To Fix
Minimum fixed version
2:9.1.1230-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid opening zip files with Vim until they have updated to the patched version. Additionally, users can use alternative text editors that do not exhibit this vulnerability for handling zip files.
Conclusion
In summary, Vim has a vulnerability that can lead to potential data loss when handling specially crafted zip files in versions prior to 9.1.1198. Users are advised to update to the latest patched version to mitigate this risk. Additionally, monitoring tools like Vulert can help keep track of vulnerabilities in your software.
See every vulnerability recorded for vim →
FAQ
Versions of Vim prior to 9.1.1198 are affected by this vulnerability.
The impact is medium, as it requires user interaction to exploit, specifically by opening a crafted zip file and pressing 'x'.
You can check your version of Vim by running the command 'vim --version' in your terminal.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json.
More information can be found in the official Debian CVE database or by visiting the Vulert playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for vim.
