CVE Feed

    Dashboard / CVE / CVE-2019-12735

    CVE-2019-12735

    getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.

    Published:Jun 5, 2019
    Last Modified:Nov 11, 2025
    EPS:Jun 5, 2019
    EPSS Score:0.55013
    CVSS Score:5.3

    Affected Products

    Vendor
    Neovim
    Product
    Neovim
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Rhel Eus
    Vendor
    Vim
    Product
    Vim

    Exploits

    https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.mdhttps://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.mdhttps://www.exploit-db.com/exploits/46973https://github.com/datntsec/CVE-2019-12735https://github.com/nickylimjj/cve-2019-12735https://github.com/oldthree3/CVE-2019-12735-VIM-NEOVIMhttps://github.com/pcy190/ace-vim-neovimhttps://github.com/st9007a/CVE-2019-12735

    Related CVEs

    CVE-2026-11487 (CVSS 1.9) — A flaw has been found in Neovim up to 0.12.2. Affected by this issue is the function M.read of the file runtim…
    CVE-2026-45130 (CVSS 6.6) — Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in r…
    CVE-2026-25749 (CVSS 6.6) — Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerabili…
    CVE-2025-22134 (CVSS 4.2) — When switching to other buffers using the :all command and visual mode still being active, this may cause a he…
    CVE-2024-43374 (CVSS 4.5) — The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When addin…
    CVE-2021-4019 (CVSS 7.8) — vim is vulnerable to Heap-based Buffer Overflow…

    References

    http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00031.html
    http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00036.html
    http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00037.html
    http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00034.html
    http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00050.html
    http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00075.html
    http://www.securityfocus.com/bid/108724
    https://access.redhat.com/errata/RHSA-2019:1619
    https://access.redhat.com/errata/RHSA-2019:1774
    https://access.redhat.com/errata/RHSA-2019:1793
    https://access.redhat.com/errata/RHSA-2019:1947
    https://bugs.debian.org/930020
    https://bugs.debian.org/930024
    https://github.com/neovim/neovim/pull/10082
    https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md
    https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040
    https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html
    https://lists.fedoraproject.org/archives/list/[email protected]/message/2BMDSHTF754TITC6AQJPCS5IRIDMMIM7/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/TRIRBC2YRGKPAWVRMZS4SZTGGCVRVZPR/
    https://seclists.org/bugtraq/2019/Jul/39
    https://seclists.org/bugtraq/2019/Jun/33
    https://security.gentoo.org/glsa/202003-04
    https://support.f5.com/csp/article/K93144355
    https://support.f5.com/csp/article/K93144355?utm_source=f5support&utm_medium=RSS
    https://usn.ubuntu.com/4016-1/
    https://usn.ubuntu.com/4016-2/
    https://www.debian.org/security/2019/dsa-4467
    https://www.debian.org/security/2019/dsa-4487
    https://www.exploit-db.com/exploits/46973
    http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00031.html
    http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00036.html
    http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00037.html
    http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00034.html
    http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00050.html
    http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00075.html
    http://www.securityfocus.com/bid/108724
    https://access.redhat.com/errata/RHSA-2019:1619
    https://access.redhat.com/errata/RHSA-2019:1774
    https://access.redhat.com/errata/RHSA-2019:1793
    https://access.redhat.com/errata/RHSA-2019:1947
    https://bugs.debian.org/930020
    https://bugs.debian.org/930024
    https://github.com/neovim/neovim/pull/10082
    https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md
    https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040
    https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BMDSHTF754TITC6AQJPCS5IRIDMMIM7/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRIRBC2YRGKPAWVRMZS4SZTGGCVRVZPR/
    https://seclists.org/bugtraq/2019/Jul/39
    https://seclists.org/bugtraq/2019/Jun/33
    https://security.gentoo.org/glsa/202003-04
    https://support.f5.com/csp/article/K93144355
    https://support.f5.com/csp/article/K93144355?utm_source=f5support&amp%3Butm_medium=RSS
    https://usn.ubuntu.com/4016-1/
    https://usn.ubuntu.com/4016-2/
    https://www.debian.org/security/2019/dsa-4467
    https://www.debian.org/security/2019/dsa-4487

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High