{"id":"CVE-2019-20807","aliases":["DEBIAN-CVE-2019-20807","DLA-2876-1","EUVD-2019-11344","GHSA-f76x-65j4-28x3","RHSA-2020:4453","RLSA-2020:4453","SUSE-SU-2020:14385-1","SUSE-SU-2020:1550-1","SUSE-SU-2020:1551-1","UBUNTU-CVE-2019-20807","USN-4582-1","USN-5147-1","openSUSE-SU-2020:0794-1"],"status":"published","title":"In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS...","description":"In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00469,"percentile":0.41032,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2020-05-28T13:05:50Z","modified":"2026-10-21T08:12:40Z","fixes":[{"ecosystem":"Debian:12","package":"vim","fixed_in":["2:8.1.2136-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vim","fixed_in":["2:8.1.2136-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vim","fixed_in":["2:8.1.2136-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-X11","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-X11-debuginfo","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-common","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-common-debuginfo","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-debuginfo","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-debugsource","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-enhanced","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-enhanced-debuginfo","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-filesystem","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-minimal-debuginfo","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"vim","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"vim-X11-debuginfo","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"vim-common-debuginfo","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"vim-debuginfo","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"vim-debugsource","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"vim-enhanced-debuginfo","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"vim-minimal","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"vim-minimal-debuginfo","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"vim","fixed_in":["2:8.0.1763-15.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"vim","fixed_in":["7.2-8.21.6.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"vim","fixed_in":["7.2-8.21.6.2"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"vim","fixed_in":["7.4.326-17.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"vim","fixed_in":["7.4.326-17.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"vim","fixed_in":["7.4.326-17.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"vim","fixed_in":["7.4.326-17.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"vim","fixed_in":["7.4.326-17.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"vim","fixed_in":["7.4.326-17.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"vim","fixed_in":["7.4.326-17.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"vim","fixed_in":["7.4.326-17.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"vim","fixed_in":["7.4.326-17.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"vim","fixed_in":["7.4.326-17.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"vim","fixed_in":["7.4.326-17.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"vim","fixed_in":["7.4.326-17.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"vim","fixed_in":["7.4.326-17.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"vim","fixed_in":["7.4.326-17.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 5","package":"vim","fixed_in":["7.4.326-17.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"vim","fixed_in":["8.0.1568-5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"vim","fixed_in":["8.0.1568-5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"vim","fixed_in":["8.0.1568-5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"vim","fixed_in":["8.0.1568-5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"vim","fixed_in":["8.0.1568-5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"vim","fixed_in":["8.0.1568-5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"vim","fixed_in":["8.0.1568-5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"vim","fixed_in":["8.0.1568-5.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","fixed_in":["2:7.4.052-1ubuntu3.1+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"vim","fixed_in":["2:7.4.1689-3ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"vim","fixed_in":["2:8.0.1453-1ubuntu1.4"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"vim","fixed_in":["8.0.1568-lp151.5.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.2136-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.2136-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.2136-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.0197-4+deb9u4"}]}],"versions":["2:8.0.0197-4","2:8.0.0197-4+deb9u1","2:8.0.0197-4+deb9u2","2:8.0.0197-4+deb9u3"],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-X11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-enhanced-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"vim-X11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"vim-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"vim-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"vim-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"vim-enhanced-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"vim-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-15.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-8.21.6.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-8.21.6.2"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.326-17.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.326-17.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.326-17.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.326-17.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.326-17.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.326-17.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.326-17.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.326-17.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.326-17.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.326-17.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.326-17.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.326-17.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.326-17.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.326-17.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.326-17.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1568-5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1568-5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1568-5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1568-5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1568-5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1568-5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1568-5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1568-5.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.052-1ubuntu3.1+esm4"}]}],"versions":["2:7.4.000-1ubuntu2","2:7.4.052-1ubuntu1","2:7.4.052-1ubuntu2","2:7.4.052-1ubuntu3","2:7.4.052-1ubuntu3.1","2:7.4.052-1ubuntu3.1+esm1","2:7.4.052-1ubuntu3.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.1689-3ubuntu1.5"}]}],"versions":["2:7.4.712-2ubuntu4","2:7.4.826-1ubuntu1","2:7.4.826-1ubuntu2","2:7.4.826-1ubuntu3","2:7.4.963-1ubuntu1","2:7.4.963-1ubuntu4","2:7.4.963-1ubuntu5","2:7.4.1689-3ubuntu1","2:7.4.1689-3ubuntu1.1","2:7.4.1689-3ubuntu1.2","2:7.4.1689-3ubuntu1.3","2:7.4.1689-3ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.4"}]}],"versions":["2:8.0.0197-4ubuntu5","2:8.0.1144-1ubuntu1","2:8.0.1401-1ubuntu1","2:8.0.1401-1ubuntu2","2:8.0.1401-1ubuntu3","2:8.0.1453-1ubuntu1","2:8.0.1453-1ubuntu1.1","2:8.0.1453-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.1689-3ubuntu1.5"}]}],"versions":["2:7.4.712-2ubuntu4","2:7.4.826-1ubuntu1","2:7.4.826-1ubuntu2","2:7.4.826-1ubuntu3","2:7.4.963-1ubuntu1","2:7.4.963-1ubuntu4","2:7.4.963-1ubuntu5","2:7.4.1689-3ubuntu1","2:7.4.1689-3ubuntu1.1","2:7.4.1689-3ubuntu1.2","2:7.4.1689-3ubuntu1.3","2:7.4.1689-3ubuntu1.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.4"}]}],"versions":["2:8.0.0197-4ubuntu5","2:8.0.1144-1ubuntu1","2:8.0.1401-1ubuntu1","2:8.0.1401-1ubuntu2","2:8.0.1401-1ubuntu3","2:8.0.1453-1ubuntu1","2:8.0.1453-1ubuntu1.1","2:8.0.1453-1ubuntu1.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.052-1ubuntu3.1+esm4"}]}],"versions":["2:7.4.000-1ubuntu2","2:7.4.052-1ubuntu1","2:7.4.052-1ubuntu2","2:7.4.052-1ubuntu3","2:7.4.052-1ubuntu3.1","2:7.4.052-1ubuntu3.1+esm1","2:7.4.052-1ubuntu3.1+esm3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.1689-3ubuntu1.5+esm3"}]}],"versions":["2:7.4.712-2ubuntu4","2:7.4.826-1ubuntu1","2:7.4.826-1ubuntu2","2:7.4.826-1ubuntu3","2:7.4.963-1ubuntu1","2:7.4.963-1ubuntu4","2:7.4.963-1ubuntu5","2:7.4.1689-3ubuntu1","2:7.4.1689-3ubuntu1.1","2:7.4.1689-3ubuntu1.2","2:7.4.1689-3ubuntu1.3","2:7.4.1689-3ubuntu1.4","2:7.4.1689-3ubuntu1.5","2:7.4.1689-3ubuntu1.5+esm2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.7"}]}],"versions":["2:8.0.0197-4ubuntu5","2:8.0.1144-1ubuntu1","2:8.0.1401-1ubuntu1","2:8.0.1401-1ubuntu2","2:8.0.1401-1ubuntu3","2:8.0.1453-1ubuntu1","2:8.0.1453-1ubuntu1.1","2:8.0.1453-1ubuntu1.3","2:8.0.1453-1ubuntu1.4","2:8.0.1453-1ubuntu1.6"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.2269-1ubuntu5.4"}]}],"versions":["2:8.1.0875-5ubuntu2","2:8.1.0875-5ubuntu3","2:8.1.0875-5ubuntu4","2:8.1.2269-1ubuntu1","2:8.1.2269-1ubuntu4","2:8.1.2269-1ubuntu5","2:8.1.2269-1ubuntu5.3"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1568-lp151.5.6.1"}]}]}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"opensuse","product":"leap"},{"vendor":"starwindsoftware","product":"command_center"},{"vendor":"starwindsoftware","product":"san_\\\u0026_nas"},{"vendor":"vim","product":"vim"}],"references":[{"url":"https://github.com/vim/vim/releases/tag/v8.1.0881","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://github.com/vim/vim/commit/8c62a08faf89663e5633dc5036cd8695c80f1075","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00018.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://support.apple.com/kb/HT211289","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://seclists.org/fulldisclosure/2020/Jul/24","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4582-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00003.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.starwindsoftware.com/security/sw-20220812-0003/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20807","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f76x-65j4-28x3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-20807","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4453","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1745476","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1842658","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4453.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-20807","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20807","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2020:4453","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014385-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172225","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20807","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201550-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172031","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201551-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-20807","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4582-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5147-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-17087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3872","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3903","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3927","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3928","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6PO7KU3LZCS7CIDBMXZNNIWTS66OAR3L/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-20807","description":"In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).","status":"published","published":"2020-05-28T13:05:50Z","modified":"2024-08-05T02:53:09.244Z","updated_at":"2026-11-02T14:20:17.431882Z"}],"euvd":[{"id":"EUVD-2019-11344","description":"In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).","status":"published","published":"2020-05-28T13:05:50Z","modified":"2024-08-05T02:53:09Z","updated_at":"2026-11-03T02:40:20.727542Z"}],"ghsa":[{"id":"GHSA-f76x-65j4-28x3","title":"In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS...","description":"In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).","status":"published","published":"2022-05-24T17:18:47Z","modified":"2023-01-27T05:02:55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:42:07.495183Z"}],"nvd":[{"id":"CVE-2019-20807","description":"In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).","status":"published","published":"2020-05-28T14:15:11.563Z","modified":"2026-06-17T02:31:13.833Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:05:47.558959Z"}],"osv":[{"id":"CVE-2019-20807","description":"In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).","status":"published","published":"2020-05-28T14:15:11.563Z","modified":"2026-10-21T08:12:40.76803682Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-20807","description":"In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).","status":"published","published":"2020-05-28T14:15:11.563Z","modified":"2026-09-21T07:03:17.96196133Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"RHSA-2020:4453","title":"Red Hat Security Advisory: vim security update","status":"published","published":"2024-09-16T03:59:45Z","modified":"2026-06-26T12:22:08.959044733Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RLSA-2020:4453","title":"Moderate: vim security update","description":"Vim (Vi IMproved) is an updated and improved version of the vi editor.\n\nSecurity Fix(es):\n\n* vim: users can execute arbitrary OS commands via scripting interfaces in the rvim restricted mode (CVE-2019-20807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:06:10Z","modified":"2026-02-05T02:00:11.536825Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-20807","description":"In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).","status":"published","published":"2020-05-28T14:15:00Z","modified":"2026-02-04T03:32:52.401408Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"DLA-2876-1","title":"vim - security update","status":"published","published":"2022-01-10T00:00:00Z","modified":"2026-03-09T01:18:25.080273Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"openSUSE-SU-2020:0794-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\n- CVE-2019-20807: Fixed an issue where escaping from the restrictive mode of vim \n  was possible using interfaces (bsc#1172225). \n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-06-11T12:20:24Z","modified":"2026-02-04T03:51:11.283974Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"SUSE-SU-2020:14385-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\n- CVE-2019-20807: Fixed an issue where escaping from the restrictive mode of vim\n  was possible using interfaces (bsc#1172225). \n","status":"published","published":"2020-06-04T10:58:46Z","modified":"2026-02-04T03:27:26.83284Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1550-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\n- CVE-2019-20807: Fixed an issue where escaping from the restrictive mode of vim \n  was possible using interfaces (bsc#1172225 and bsc#1172031).\t  \n","status":"published","published":"2020-06-08T07:30:38Z","modified":"2025-05-02T04:09:11.135391Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1551-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\n- CVE-2019-20807: Fixed an issue where escaping from the restrictive mode of vim \n  was possible using interfaces (bsc#1172225). \n","status":"published","published":"2020-06-08T07:32:19Z","modified":"2026-02-04T02:24:47.828449Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-4582-1","title":"vim vulnerabilities","description":"It was discovered that Vim incorrectly handled permissions on the .swp\nfile. A local attacker could possibly use this issue to obtain sensitive\ninformation. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-17087)\n\nIt was discovered that Vim incorrectly handled restricted mode. A local\nattacker could possibly use this issue to bypass restricted mode and\nexecute arbitrary commands. Note: This update only makes executing shell\ncommands more difficult. Restricted mode should not be considered a\ncomplete security measure. (CVE-2019-20807)\n","status":"published","published":"2020-10-14T16:22:24Z","modified":"2026-02-10T04:41:57Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-5147-1","title":"vim vulnerabilities","description":"It was discovered that Vim incorrectly handled permissions on the .swp\nfile. A local attacker could possibly use this issue to obtain sensitive\ninformation. This issue only affected Ubuntu 14.04 ESM. (CVE-2017-17087)\n\nIt was discovered that Vim incorrectly handled restricted mode. A local\nattacker could possibly use this issue to bypass restricted mode and\nexecute arbitrary commands. Note: This update only makes executing shell\ncommands more difficult. Restricted mode should not be considered a\ncomplete security measure. This issue only affected Ubuntu 14.04 ESM.\n(CVE-2019-20807)\n\nBrian Carpenter discovered that vim incorrectly handled memory\nwhen opening certain files. If a user was tricked into opening\na specially crafted file, a remote attacker could crash the\napplication, leading to a denial of service, or possible execute\narbitrary code with user privileges. This issue only affected\nUbuntu 20.04 LTS, Ubuntu 21.04 and Ubuntu 21.10. (CVE-2021-3872)\n\nIt was discovered that vim incorrectly handled memory when\nopening certain files. If a user was tricked into opening\na specially crafted file, a remote attacker could crash the\napplication, leading to a denial of service, or possible execute\narbitrary code with user privileges. (CVE-2021-3903)\n\nIt was discovered that vim incorrectly handled memory when\nopening certain files. If a user was tricked into opening\na specially crafted file, a remote attacker could crash the\napplication, leading to a denial of service, or possible execute\narbitrary code with user privileges. (CVE-2021-3927)\n\nIt was discovered that vim incorrectly handled memory when\nopening certain files. If a user was tricked into opening\na specially crafted file, a remote attacker could crash the\napplication, leading to a denial of service, or possible execute\narbitrary code with user privileges. (CVE-2021-3928)\n","status":"published","published":"2021-11-15T13:47:04Z","modified":"2026-06-29T13:49:34.953120693Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}