VYPR
← All advisories
Unrated severityNVD Advisory· Published Jun 5, 2019· Updated Nov 11, 2025

CVE-2019-12735

CVE-2019-12735

Description

Vim before 8.1.1365 and Neovim before 0.3.6 allow arbitrary OS command execution via a crafted modeline using the :source! command.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Vim before 8.1.1365 and Neovim before 0.3.6 allow arbitrary OS command execution via a crafted modeline using the :source! command.

Vulnerability

The vulnerability resides in the modeline feature of Vim and Neovim, which allows editor options to be specified within a file. In affected versions (Vim before 8.1.1365, Neovim before 0.3.6), the :source! command can be executed through a modeline via expression options like assert_fails or nvim_input. This allows arbitrary OS commands to be run when the file is opened if the modeline option is enabled (default) [1][4].

Exploitation

An attacker crafts a text file containing a malicious modeline, such as :!uname -a||" vi:fen:fdm=expr:fde=assert_fails("source\!\ \%"):fdl=0:fdt=". When the victim opens the file with Vim or Neovim, the modeline is processed and the injected command executes. No authentication or special position is required; only user interaction (opening the file) is needed. The attack can be extended to execute arbitrary commands, including reverse shells, with additional obfuscation using terminal escape sequences to hide the modeline when viewed with cat [4].

Impact

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the user who opened the file. This can lead to complete compromise of the affected system, including data theft, malware installation, or further network propagation.

Mitigation

Vim patched the issue in version 8.1.1365 (released June 4, 2019) and Neovim in version 0.3.6. Red Hat released updates for various versions via RHSA-2019:1619 and later advisories [1]. Users should update to the latest versions or disable modelines by setting :set nomodeline in their configuration. There are no known workarounds if the software cannot be updated.

References
  1. https://access.redhat.com/errata/RHSA-2019:1619
  2. OffSec’s Exploit Database Archive

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

31

Patches

0

No patches discovered yet.

Vulnerability mechanics

Synthesis attempt was rejected by the grounding validator. Re-run pending.

References

29

News mentions

0

No linked articles in our index yet.