vim records

Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properl

• pre-auth RCE

vim · vimJun 16, 2008

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command i

• RCE
• Command injection

vim · vimJun 5, 2019

Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell

• pre-auth RCE

vim · vimSep 18, 2008

Untrusted search path vulnerability in VIM Development Group GVim before 7.3.034, and possibly other versions before 7.3.46, allows local us

• pre-auth RCE

vim · gvimNov 3, 2010

The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filena

• pre-auth RCE
• Command injection

vim · vimFeb 21, 2009

An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate

• Pre-auth
• Memory safety

vim · vimFeb 27, 2017

vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overf

• Pre-auth
• Memory safety

vim · vimFeb 10, 2017

An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate valu

• Pre-auth
• Memory safety

vim · vimFeb 27, 2017

Heap-based Buffer Overflow in vim/vim

• Pre-auth
• Memory safety

vim · vimJan 21, 2022

Heap-based Buffer Overflow in vim/vim

• Memory safety

vim · vimFeb 14, 2022

vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execu

• RCE

vim · vimNov 23, 2016

Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand parameter.

• pre-auth RCE
• Memory safety

vim · vimJun 20, 2023

Heap-based Buffer Overflow in vim/vim

• Pre-auth
• Memory safety

vim · vimDec 2, 2022

The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (ex

• pre-auth RCE

vim · vimFeb 21, 2009

The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (ex

• pre-auth RCE
• Command injection

vim · tar.vimFeb 21, 2009

The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a f

• pre-auth RCE
• Command injection

vim · vimFeb 21, 2009

Improper Input Validation in Vim

• RCE
• Command injection

vim · vimMar 3, 2025

Use of Out-of-range Pointer Offset in vim/vim

vim · vimFeb 23, 2022

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr}

• RCE
• Command injection

vim · vimMar 30, 2026

Heap-based Buffer Overflow in vim/vim

• Memory safety

vim · vimNov 19, 2021

Vim: Arbitrary Code Execution via PHP Omni-Completion

• RCE

vim · vimJul 9, 2026

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within fi

• RCE
• Denial of service

vim · vimAug 4, 2026

Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings

• RCE

vim · vimJun 25, 2026

Vim: Arbitrary Code Execution via C Omni-Completion

• RCE

vim · vimJul 9, 2026

global heap buffer overflow in skip_range in vim/vim

• Memory safety

vim · vimApr 17, 2022