Every CVE Search/ Get API key

CVE-2008-4101

Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user...

9.3 HighPublic exploitFix available

Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell commands by entering a K keystroke on a line that contains a ";" (semicolon) followed by a command, or execute arbitrary Ex commands by entering an argument after a (2) "Ctrl-]" (control close-square-bracket) or (3) "g]" (g close-square-bracket) keystroke sequence, a different issue than CVE-2008-2712.

Exploit likelihood

9.21%Up 2.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.3

Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell commands by entering a K keystroke on a line that contains a ";" (semicolon) followed by a command, or execute arbitrary Ex commands by entering an argument after a (2) "Ctrl-]" (control close-square-bracket) or (3) "g]" (g close-square-bracket) keystroke sequence, a different issue than CVE-2008-2712.

Record
CVE-2008-4101
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell commands by entering a K keystroke on a line that contains a ";" (semicolon) followed by a command, or execute arbitrary Ex commands by entering an argument after a (2) "Ctrl-]" (control close-square-bracket) or (3) "g]" (g close-square-bracket) keystroke sequence, a different issue than CVE-2008-2712.

Record
CVE-2008-4101
Updated
2026-11-02
EUVDEUVD-2008-4085 No score

Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell commands by entering a K keystroke on a line that contains a ";" (semicolon) followed by a command, or execute arbitrary Ex commands by entering an argument after a (2) "Ctrl-]" (control close-square-bracket) or (3) "g]" (g close-square-bracket) keystroke sequence, a different issue than CVE-2008-2712.

Record
EUVD-2008-4085
Updated
2026-11-03
GitHub AdvisoriesGHSA-2gqj-jjm7-f6m7 No score

Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user...

Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell commands by entering a K keystroke on a line that contains a ";" (semicolon) followed by a command, or execute arbitrary Ex commands by entering an argument after a (2) "Ctrl-]" (control close-square-bracket) or (3) "g]" (g close-square-bracket) keystroke sequence, a different issue than CVE-2008-2712.

Record
GHSA-2gqj-jjm7-f6m7
Weakness
CWE-20
Updated
2026-11-02
OSV No score

Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell commands by entering a K keystroke on a line that contains a ";" (semicolon) followed by a command, or execute arbitrary Ex commands by entering an argument after a (2) "Ctrl-]" (control close-square-bracket) or (3) "g]" (g close-square-bracket) keystroke sequence, a different issue than CVE-2008-2712.

Record
CVE-2008-4101
Updated
2026-11-02
OSVDEBIAN-CVE-2008-4101 No score

Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell commands by entering a K keystroke on a line that contains a ";" (semicolon) followed by a command, or execute arbitrary Ex commands by entering an argument after a (2) "Ctrl-]" (control close-square-bracket) or (3) "g]" (g close-square-bracket) keystroke sequence, a different issue than CVE-2008-2712.

Record
DEBIAN-CVE-2008-4101
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
vim
Debian:12
 before 2:7.2.010-1
2:7.2.010-1
vim
Debian:13
 before 2:7.2.010-1
2:7.2.010-1
vim
Debian:14
 before 2:7.2.010-1
2:7.2.010-1
vim
Debian:4.0
From an advisory covering 5 CVEs
 before 1:7.0-122+1etch5, plus listed versions
1:7.0-122+1etch21:7.0-122+1etch31:7.0-122+1etch4
1:7.0-122+1etch5
vim
Red Hat:enterprise_linux:5::client
From an advisory covering 6 CVEs
 before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-X11
Red Hat:enterprise_linux:5::client
From an advisory covering 6 CVEs
 before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-common
Red Hat:enterprise_linux:5::client
From an advisory covering 6 CVEs
 before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 6 CVEs
 before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-enhanced
Red Hat:enterprise_linux:5::client
From an advisory covering 6 CVEs
 before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-minimal
Red Hat:enterprise_linux:5::client
From an advisory covering 6 CVEs
 before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
Show 74 moreShow less
Affected packages
PackageAffectedFixed
vim
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
 before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-X11
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
 before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-common
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
 before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
 before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-enhanced
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
 before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim-minimal
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
 before 2:7.0.109-4.el5_2.4z
2:7.0.109-4.el5_2.4z
vim
Red Hat:enterprise_linux:3::as
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-X11
Red Hat:enterprise_linux:3::as
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-common
Red Hat:enterprise_linux:3::as
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-debuginfo
Red Hat:enterprise_linux:3::as
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-enhanced
Red Hat:enterprise_linux:3::as
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-minimal
Red Hat:enterprise_linux:3::as
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim
Red Hat:enterprise_linux:3::desktop
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-X11
Red Hat:enterprise_linux:3::desktop
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-common
Red Hat:enterprise_linux:3::desktop
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-debuginfo
Red Hat:enterprise_linux:3::desktop
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-enhanced
Red Hat:enterprise_linux:3::desktop
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-minimal
Red Hat:enterprise_linux:3::desktop
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim
Red Hat:enterprise_linux:3::es
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-X11
Red Hat:enterprise_linux:3::es
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-common
Red Hat:enterprise_linux:3::es
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-debuginfo
Red Hat:enterprise_linux:3::es
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-enhanced
Red Hat:enterprise_linux:3::es
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-minimal
Red Hat:enterprise_linux:3::es
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim
Red Hat:enterprise_linux:3::ws
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-X11
Red Hat:enterprise_linux:3::ws
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-common
Red Hat:enterprise_linux:3::ws
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-debuginfo
Red Hat:enterprise_linux:3::ws
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-enhanced
Red Hat:enterprise_linux:3::ws
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim-minimal
Red Hat:enterprise_linux:3::ws
From an advisory covering 4 CVEs
 before 1:6.3.046-0.30E.11
1:6.3.046-0.30E.11
vim
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-X11
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-common
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-debuginfo
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-enhanced
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-minimal
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-X11
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-common
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-debuginfo
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-enhanced
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-minimal
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-X11
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-common
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-debuginfo
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-enhanced
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-minimal
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-X11
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-common
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-debuginfo
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-enhanced
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim-minimal
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 1:6.3.046-1.el4_7.5z
1:6.3.046-1.el4_7.5z
vim
Red Hat:enterprise_linux:2.1::as
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim-X11
Red Hat:enterprise_linux:2.1::as
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim-common
Red Hat:enterprise_linux:2.1::as
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim-enhanced
Red Hat:enterprise_linux:2.1::as
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim-minimal
Red Hat:enterprise_linux:2.1::as
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim
Red Hat:enterprise_linux:2.1::aw
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim-X11
Red Hat:enterprise_linux:2.1::aw
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim-common
Red Hat:enterprise_linux:2.1::aw
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim-enhanced
Red Hat:enterprise_linux:2.1::aw
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim-minimal
Red Hat:enterprise_linux:2.1::aw
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim
Red Hat:enterprise_linux:2.1::es
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim-X11
Red Hat:enterprise_linux:2.1::es
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim-common
Red Hat:enterprise_linux:2.1::es
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim-enhanced
Red Hat:enterprise_linux:2.1::es
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim-minimal
Red Hat:enterprise_linux:2.1::es
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim
Red Hat:enterprise_linux:2.1::ws
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim-X11
Red Hat:enterprise_linux:2.1::ws
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim-common
Red Hat:enterprise_linux:2.1::ws
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim-enhanced
Red Hat:enterprise_linux:2.1::ws
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25
vim-minimal
Red Hat:enterprise_linux:2.1::ws
From an advisory covering 2 CVEs
 before 1:6.0-7.25
1:6.0-7.25

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBVim 7.1.314 - Insufficient Shell Escaping Multiple Command Execution Vulnerabilities2008-08-19

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-4101 is a high vulnerability (CVSS 9.3) in Vim, published September 18, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.21%, the 95th percentile. Fixed in vim 2:7.2.010-1.

References

Show 69 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open