Skip to content

CVE-2007-2438

The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3)...

7.6 HighFix available

CVE-2007-2438 is a high vulnerability (CVSS 7.6) in Vim Development Group Vim, published May 2, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.22%, the 88th percentile. Fixed in vim 1:7.1-022+1.

The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write files via modelines.

Exploit likelihood

3.22%Up 0.5 points since Feb 4, 2022

What each source reports

NVD Score used 7.6

The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write files via modelines.

Record: CVE-2007-2438
CVSS 2.0: 7.6 HighAV:N/AC:H/Au:N/C:C/I:C/A:C
Updated: 2026-11-02

CVE List No score

The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write files via modelines.

Record: CVE-2007-2438
Updated: 2026-11-02

EUVDEUVD-2007-2433 No score

The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write files via modelines.

Record: EUVD-2007-2433
Updated: 2026-11-03

GitHub AdvisoriesGHSA-x2f5-352x-j9w7 No score

The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3)...

The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write files via modelines.

Record: GHSA-x2f5-352x-j9w7
Updated: 2026-11-02

OSV No score

The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write files via modelines.

Record: CVE-2007-2438
Updated: 2026-11-02

OSVDEBIAN-CVE-2007-2438 No score

The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write files via modelines.

Record: DEBIAN-CVE-2007-2438
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11497-1 No score

gvim-8.2.3408-1.2 on GA media

These are all security issues fixed in the gvim-8.2.3408-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11497-1
Updated: 2026-11-02

Affected products

vim development group vim

Affected packages

Affected packages
Package	Affected	Fixed
`vim` Debian:12	before 1:7.1-022+1	1:7.1-022+1
`vim` Debian:13	before 1:7.1-022+1	1:7.1-022+1
`vim` Debian:14	before 1:7.1-022+1	1:7.1-022+1
`vim` Debian:3.1	before 1:6.3-071+1sarge2, plus listed versions 1:6.3-071+11:6.3-071+1sarge1	1:6.3-071+1sarge2
`vim` Debian:4.0	before 1:7.0-122+1etch3, plus listed versions 1:7.0-122+1etch2	1:7.0-122+1etch3
`vim` Red Hat:enterprise_linux:5::client	before 2:7.0.109-3.el5.3	2:7.0.109-3.el5.3
`vim-X11` Red Hat:enterprise_linux:5::client	before 2:7.0.109-3.el5.3	2:7.0.109-3.el5.3
`vim-common` Red Hat:enterprise_linux:5::client	before 2:7.0.109-3.el5.3	2:7.0.109-3.el5.3
`vim-debuginfo` Red Hat:enterprise_linux:5::client	before 2:7.0.109-3.el5.3	2:7.0.109-3.el5.3
`vim-enhanced` Red Hat:enterprise_linux:5::client	before 2:7.0.109-3.el5.3	2:7.0.109-3.el5.3

Show 8 moreShow less

Affected packages
Package	Affected	Fixed
`vim-minimal` Red Hat:enterprise_linux:5::client	before 2:7.0.109-3.el5.3	2:7.0.109-3.el5.3
`vim` Red Hat:enterprise_linux:5::server	before 2:7.0.109-3.el5.3	2:7.0.109-3.el5.3
`vim-X11` Red Hat:enterprise_linux:5::server	before 2:7.0.109-3.el5.3	2:7.0.109-3.el5.3
`vim-common` Red Hat:enterprise_linux:5::server	before 2:7.0.109-3.el5.3	2:7.0.109-3.el5.3
`vim-debuginfo` Red Hat:enterprise_linux:5::server	before 2:7.0.109-3.el5.3	2:7.0.109-3.el5.3
`vim-enhanced` Red Hat:enterprise_linux:5::server	before 2:7.0.109-3.el5.3	2:7.0.109-3.el5.3
`vim-minimal` Red Hat:enterprise_linux:5::server	before 2:7.0.109-3.el5.3	2:7.0.109-3.el5.3
`vim` openSUSE:Tumbleweed	before 8.2.3408-1.2	8.2.3408-1.2

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	affected, aliases, facts, references, title	GitHub Advisories, OSV
2026-11-02	created	CVE List, NVD

References

Show 41 moreShow less