Skip to content
Fencer Vulns
high 8.6

CVE-2019-12735 in the critical feed json

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source!

published 2019-06-05 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-4324

cvss
8.6
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
19.0%
EPSS 19.0% chance of exploitation in 30 days, percentile 97%
public exploits
1
Exploit-DB

Summary

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.

Patch / fix

  • vim vim 8.1.1365
  • neovim neovim 0.3.6
  • vim Debian 14, Debian 13, Debian 12 2:8.1.0875-4
  • neovim Debian 14, Debian 13, Debian 12 0.3.4-3

debian advisories DEBIAN-CVE-2019-12735

  • vim Ubuntu 16.04 LTS 2:7.4.1689-3ubuntu1.3
  • vim Ubuntu 18.04 LTS 2:8.0.1453-1ubuntu1.1
  • neovim Ubuntu Pro 18.04 LTS 0.2.2-3ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2019-12735

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • vim RHEL 6 2:7.4.629-5.el6_10.2
  • vim-X11 RHEL 6 2:7.4.629-5.el6_10.2
  • vim-common RHEL 6 2:7.4.629-5.el6_10.2
  • vim-minimal RHEL 6 2:7.4.629-5.el6_10.2
  • vim-enhanced RHEL 6 2:7.4.629-5.el6_10.2
  • vim-filesystem RHEL 6 2:7.4.629-5.el6_10.2
  • vim RHEL 7 2:7.4.160-6.el7_6
  • vim RHEL 8 2:8.0.1763-11.el8_0

red hat advisories RHSA-2019:1793RHSA-2019:1947RHSA-2019:1774RHSA-2019:1619

  • vim SLE Module for Desktop Applications 15 SP1, SLE Module for Desktop Applications 15, SLE Module for Basesystem 15 SP1 +1 more 8.0.1568-5.3.1
  • vim SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES for SAP 12 SP2 +11 more 7.4.326-17.3.1
  • vim SLES 11 SP4-LTSS, SLE Point of Sale 11 SP3 7.2-8.21.3.1

suse advisories SUSE-SU-2019:1457-1SUSE-SU-2019:1456-1SUSE-SU-2019:14078-1

  • neovim openSUSE Tumbleweed 0.5.1-1.1
  • vim openSUSE Tumbleweed 8.2.3408-1.2
  • neovim Package Hub 15 SP1 0.3.7-bp151.3.3.1
  • neovim Package Hub 15 0.3.7-bp150.2.9.1
  • neovim openSUSE Leap 15.1, openSUSE Leap 15.0 0.3.7-lp151.2.7.1
  • vim openSUSE Leap 15.1, openSUSE Leap 15.0 8.0.1568-lp151.5.3.1
  • neovim Package Hub 15, openSUSE Leap 15.1, openSUSE Leap 15.0 0.3.1-bp150.2.6.1

opensuse advisories openSUSE-SU-2024:11081-1openSUSE-SU-2024:11497-1openSUSE-SU-2019:1997-1openSUSE-SU-2019:1796-1openSUSE-SU-2019:1759-1openSUSE-SU-2019:1561-1

  • vim Alpine 3.24, Alpine 3.23, Alpine 3.22 +13 more 8.1.1365-r0
  • vim Alpine 3.7 8.0.1359-r2
  • vim Alpine 3.8 8.1.1365
  • neovim Alpine 3.24, Alpine 3.23, Alpine 3.22 +12 more 0.3.6-r0

alpine advisories ALPINE-CVE-2019-12735

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • vim Arch Linux 8.1.1467-1
  • gvim Arch Linux 8.1.1467-1
  • neovim Arch Linux 0.3.6-1

arch linux advisories AVG-975AVG-976AVG-979

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-12735 updated cvss 5.3

vim/neovim: ': source!' command allows arbitrary command execution via modelines

  • Red Hat Enterprise Linux 5 vim
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 8) vim-X11 8.0.1763-11.el8_0, vim-common 8.0.1763-11.el8_0, vim-enhanced 8.0.1763-11.el8_0, vim-filesystem 8.0.1763-11.el8_0 Red Hat Enterprise Linux BaseOS (v. 8) vim 8.0.1763-11.el8_0, vim-minimal 8.0.1763-11.el8_0 Red Hat Enterprise Linux Client (v. 7) vim 7.4.160-6.el7_6, vim-X11 7.4.160-6.el7_6, vim-common 7.4.160-6.el7_6, vim-minimal 7.4.160-6.el7_6, vim-enhanced 7.4.160-6.el7_6, vim-filesystem 7.4.160-6.el7_6 Red Hat Enterprise Linux ComputeNode (v. 7) vim 7.4.160-6.el7_6, vim-common 7.4.160-6.el7_6, vim-minimal 7.4.160-6.el7_6, vim-enhanced 7.4.160-6.el7_6, vim-filesystem 7.4.160-6.el7_6
    fixed: vendor fix RHSA-2019:1619
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.4) vim 7.4.160-2.el7_4.1, vim-common 7.4.160-2.el7_4.1, vim-minimal 7.4.160-2.el7_4.1, vim-enhanced 7.4.160-2.el7_4.1, vim-filesystem 7.4.160-2.el7_4.1
    fixed: vendor fix RHSA-2019:1947
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) vim 7.4.160-4.el7_5.1, vim-common 7.4.160-4.el7_5.1, vim-minimal 7.4.160-4.el7_5.1, vim-enhanced 7.4.160-4.el7_5.1, vim-filesystem 7.4.160-4.el7_5.1
    fixed: vendor fix RHSA-2019:1793
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7) vim-X11 7.4.160-6.el7_6
    fixed: vendor fix RHSA-2019:1619
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.4) vim-X11 7.4.160-2.el7_4.1
    fixed: vendor fix RHSA-2019:1947
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) vim-X11 7.4.160-4.el7_5.1
    fixed: vendor fix RHSA-2019:1793
  • Red Hat Enterprise Linux Desktop (v. 6) vim 7.4.629-5.el6_10.2, vim-X11 7.4.629-5.el6_10.2, vim-common 7.4.629-5.el6_10.2, vim-minimal 7.4.629-5.el6_10.2, vim-enhanced 7.4.629-5.el6_10.2, vim-filesystem 7.4.629-5.el6_10.2
    fixed: vendor fix RHSA-2019:1774
show 7 more
  • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) vim 7.4.160-6.el7_6, vim-X11 7.4.160-6.el7_6, vim-common 7.4.160-6.el7_6, vim-minimal 7.4.160-6.el7_6, vim-enhanced 7.4.160-6.el7_6, vim-filesystem 7.4.160-6.el7_6
    fixed: vendor fix RHSA-2019:1619
  • Red Hat Enterprise Linux HPC Node (v. 6) vim 7.4.629-5.el6_10.2, vim-common 7.4.629-5.el6_10.2, vim-minimal 7.4.629-5.el6_10.2, vim-enhanced 7.4.629-5.el6_10.2, vim-filesystem 7.4.629-5.el6_10.2 Red Hat Enterprise Linux HPC Node Optional (v. 6) vim-X11 7.4.629-5.el6_10.2 Red Hat Enterprise Linux Server (v. 6) vim 7.4.629-5.el6_10.2, vim-X11 7.4.629-5.el6_10.2, vim-common 7.4.629-5.el6_10.2, vim-minimal 7.4.629-5.el6_10.2, vim-enhanced 7.4.629-5.el6_10.2, vim-filesystem 7.4.629-5.el6_10.2
    fixed: vendor fix RHSA-2019:1774
  • Red Hat Enterprise Linux Server (v. 7) vim 7.4.160-6.el7_6, vim-X11 7.4.160-6.el7_6, vim-common 7.4.160-6.el7_6, vim-minimal 7.4.160-6.el7_6, vim-enhanced 7.4.160-6.el7_6, vim-filesystem 7.4.160-6.el7_6
    fixed: vendor fix RHSA-2019:1619
  • Red Hat Enterprise Linux Server EUS (v. 7.4) vim 7.4.160-2.el7_4.1, vim-X11 7.4.160-2.el7_4.1, vim-common 7.4.160-2.el7_4.1, vim-minimal 7.4.160-2.el7_4.1, vim-enhanced 7.4.160-2.el7_4.1, vim-filesystem 7.4.160-2.el7_4.1
    fixed: vendor fix RHSA-2019:1947
  • Red Hat Enterprise Linux Server EUS (v. 7.5) vim 7.4.160-4.el7_5.1, vim-X11 7.4.160-4.el7_5.1, vim-common 7.4.160-4.el7_5.1, vim-minimal 7.4.160-4.el7_5.1, vim-enhanced 7.4.160-4.el7_5.1, vim-filesystem 7.4.160-4.el7_5.1
    fixed: vendor fix RHSA-2019:1793
  • Red Hat Enterprise Linux Workstation (v. 6) vim 7.4.629-5.el6_10.2, vim-X11 7.4.629-5.el6_10.2, vim-common 7.4.629-5.el6_10.2, vim-minimal 7.4.629-5.el6_10.2, vim-enhanced 7.4.629-5.el6_10.2, vim-filesystem 7.4.629-5.el6_10.2
    fixed: vendor fix RHSA-2019:1774
  • Red Hat Enterprise Linux Workstation (v. 7) vim 7.4.160-6.el7_6, vim-X11 7.4.160-6.el7_6, vim-common 7.4.160-6.el7_6, vim-minimal 7.4.160-6.el7_6, vim-enhanced 7.4.160-6.el7_6, vim-filesystem 7.4.160-6.el7_6
    fixed: vendor fix RHSA-2019:1619

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-46973)
  2. Published

Exploit prediction

18.96% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-46973 Vim < 8.1.1365 / Neovim < 0.3.6 - Arbitrary Code Execution local, 2019-06-04
  • github.com https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 8.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.