CVE-2019-12735

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.

CVSS v3.0 NVD

8.6 HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVSS v2.0 NVD

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

18.96% chance of exploitation in the next 30 days, 97th percentile

Published

2019-06-05

Updated

2025-11-11

Proof-of-concept exploits (6)

• numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md872★ · 2019-06-11
• datntsec/CVE-2019-127350★ · 2020-10-27
• nickylimjj/cve-2019-127351★ · 2021-05-28
• oldthree3/CVE-2019-12735-VIM-NEOVIM2★ · 2019-06-19
• st9007a/CVE-2019-127350★ · 2022-07-26
• vicmej/modeline-vim0★ · 2019-06-22

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/46973

Security advisories

• https://bugs.debian.org/930020
• https://bugs.debian.org/930024
• neovim/neovim/pull/10082
• vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040
• http://www.securityfocus.com/bid/108724
• https://usn.ubuntu.com/4016-1
• https://usn.ubuntu.com/4016-2

References

• CVE Record
• NVD entry

Related

• CVE-2019-13272
• CVE-2020-0796
• CVE-2020-1206