Every CVE Search/ Get API key

CVE-2025-27423

Improper Input Validation in Vim

7.1 HighFix available

Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

22.5%Up 22.4 points since Mar 4, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.1

Improper Input Validation in Vim

Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164

Record
CVE-2025-27423
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-77
Updated
2026-11-02
EUVDEUVD-2025-6012 7.1

Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164

Record
EUVD-2025-6012
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
NVD 7.1

Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164

Record
CVE-2025-27423
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-77
Updated
2026-11-02
OSVALPINE-CVE-2025-27423 7.1

Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164

Record
ALPINE-CVE-2025-27423
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-03
OSVBELL-CVE-2025-27423 7.1
Record
BELL-CVE-2025-27423
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSV 7.1

Improper Input Validation in Vim

Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164

Record
CVE-2025-27423
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-77
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2025-27423 7.1

Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164

Record
DEBIAN-CVE-2025-27423
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVAZL-57735 No score

CVE-2025-27423 affecting package vim for versions less than 9.1.1164-1

Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164

Record
AZL-57735
Updated
2026-11-02
OSVAZL-57746 No score

CVE-2025-27423 affecting package vim for versions less than 9.1.1164-1

Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164

Record
AZL-57746
Updated
2026-11-02
OSVMGASA-2025-0089 No score

Updated vim packages fix security vulnerability

Potential code execution with tar.vim and special crafted tar files.

Record
MGASA-2025-0089
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
vim
Alpine:v3.22
 9.1.0858 up to 9.1.1164-r0
9.1.1164-r0
vim
Alpine:v3.23
 9.1.0858 up to 9.1.1164-r0
9.1.1164-r0
vim
Alpine:v3.24
 9.1.0858 up to 9.1.1164-r0
9.1.1164-r0
vim
Azure Linux:3
 before 9.1.1164-1
9.1.1164-1
vim
Azure Linux:2
 before 9.1.1164-1
9.1.1164-1
vim
Alpaquita:23
 9.1.0936-r0 up to 9.1.1164-r0
9.1.1164-r0
vim
Alpaquita:stream
 9.1.0936-r0 up to 9.1.1164-r0
9.1.1164-r0
vim
Debian:13
 before 2:9.1.1230-1
2:9.1.1230-1
vim
Debian:14
 before 2:9.1.1230-1
2:9.1.1230-1
vim
Mageia:9
 before 9.1.1166-1.mga9
9.1.1166-1.mga9

History

History
RecordedChangedSources
affectedOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-27423 is a high vulnerability (CVSS 7.1) in Vim, published March 3, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 22.5%, the 97th percentile. Fixed in vim 9.1.1164-r0.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open