Back to Database
Status published
High
CVE-2019-12735
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows...
Vulnerability Description
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-12735
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md
- https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040
- https://github.com/neovim/neovim/pull/10082
- https://bugs.debian.org/930020
- https://bugs.debian.org/930024
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2BMDSHTF754TITC6AQJPCS5IRIDMMIM7/
- https://usn.ubuntu.com/4016-1/
- https://usn.ubuntu.com/4016-2/
- http://www.securityfocus.com/bid/108724
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TRIRBC2YRGKPAWVRMZS4SZTGGCVRVZPR/
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00037.html
- https://www.debian.org/security/2019/dsa-4467
- https://seclists.org/bugtraq/2019/Jun/33
- https://support.f5.com/csp/article/K93144355
- https://access.redhat.com/errata/RHSA-2019:1619
- https://access.redhat.com/errata/RHSA-2019:1774
- https://access.redhat.com/errata/RHSA-2019:1793
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00034.html
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00050.html
- https://www.debian.org/security/2019/dsa-4487
- https://seclists.org/bugtraq/2019/Jul/39
- https://access.redhat.com/errata/RHSA-2019:1947
- https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00075.html
- https://support.f5.com/csp/article/K93144355?utm_source=f5support&utm_medium=RSS
- https://security.gentoo.org/glsa/202003-04
- https://www.exploit-db.com/exploits/46973
More from vim
View All →CVE-2025-66476
Vim for Windows Uncontrolled Search Path Element Remote Code Execution Vulnerability
High
7.8
CVE-2025-55158
Vim double-free vulnerability during Vim9 script import operations
Medium
6.9
CVE-2025-55157
Vim heap use-after-free vulnerability when processing recursive tuple data types
Medium
6.9
CVE-2025-53906
Vim has path traversal issue with zip.vim and special crafted zip archives
Medium
4.1
CVE-2025-53905
Vim has path traversial issue with tar.vim and special crafted tar files
Medium
4.1
Affected Vendor
Affected Software
vim, neovim
Vulnerable Versions:
0
Timeline
Official Publish:
June 5th, 2019
Last Modified:
November 11th, 2025
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.