PT-2025-9524 · Vim+3 · Vim+3

Ry0Tak · Published 2025-03-02 · Updated 2025-05-02 · CVE-2025-27423

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vim versions 9.1.0858 through 9.1.1163

Description Vim is an open source, command line text editor that is distributed with the tar.vim plugin. This plugin allows easy editing and viewing of compressed or uncompressed tar files. However, starting with version 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position without sanitizing the input, which can be taken literally from the tar archive. This allows for the execution of shell commands via specially crafted tar archives, depending on the shell being used. The issue has been fixed as of Vim patch v9.1.1164.

Recommendations Update to version 9.1.1164 to stay secure. Avoid opening untrusted TAR files. Monitor for unusual events. As a temporary workaround, consider disabling the tar.vim plugin until a patch is available.

Exploit

Fix

RCE

Command Injection

Weakness Enumeration

CWE-20

CWE-77

Related Identifiers

ALT-PU-2025-5044

ALT-PU-2025-5579

ALT-PU-2025-5591

AZL-57735

AZL-57746

BDU:2025-06069

CVE-2025-27423

GHSA-WFMF-8626-Q3R3

MGASA-2025-0089

Affected Products

Alt Linux

Debian

Red Os

Vim

References · 44

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27423.json · Exploit
• https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3 · Vendor Advisory
• https://github.com/vim/vim/commit/129a8446d23cd9cb4445fcfea259cba5e0487d29 · Patch
• https://github.com/vim/vim/commit/334a13bff78aa0ad206bc436885f63e3a0bab399 · Patch
• https://cve.org/CVERecord?id=CVE-2025-27423 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-27423 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27423 · Security Note
• https://osv.dev/vulnerability/AZL-57735 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0089.html · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2025-27423 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27423 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0089 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-27423 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-57746 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-27423 · Vendor Advisory