CVE-2008-4101
Description
Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell commands by entering a K keystroke on a line that contains a ";" (semicolon) followed by a command, or execute arbitrary Ex commands by entering an argument after a (2) "Ctrl-]" (control close-square-bracket) or (3) "g]" (g close-square-bracket) keystroke sequence, a different issue than CVE-2008-2712.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
Vim 7.1.314 - Insufficient Shell Escaping Multiple Command Execution Vulnerabilities
source: https://www.securityfocus.com/bid/30795/info
Vim is prone to multiple command-execution vulnerabilities because the application fails to sufficiently sanitize user-supplied data.
Successfully exploiting these issues can allow an attacker to execute arbitrary commands with the privileges of the user running the affected application.
Versions prior to Vim 7.2.010 are vulnerable.
Copy-and-paste these examples into separate files:
;xclock
vim: set iskeyword=;,@
Place your cursor on ``xclock'', and press K. xclock appears.
;date>>pwned
vim: set iskeyword=1-255
Place your cursor on ``date'' and press K. File ``pwned'' is created in
the current working directory.
Please note: If modeline processing is disabled, set the 'iskeyword'
option manually. OS impact
Debian Fixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 2:7.2.010-1 |
| sid | Fixed | 2:7.2.010-1 |
| forky | Fixed | 2:7.2.010-1 |
| bullseye | Fixed | 2:7.2.010-1 |
| bookworm | Fixed | 2:7.2.010-1 |
References
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.