CVE-2025-27423

Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164

• CWE-77

• https://github.com/vim/vim/commit/129a8446d23cd9cb4445fcfea259cba5e0487d29Patch
• https://github.com/vim/vim/commit/334a13bff78aa0ad206bc436885f63e3a0bab399Patch
• https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3Vendor Advisory
• https://security.netapp.com/advisory/ntap-20250502-0002/Third Party Advisory

Published

Mar 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27418WeGIA is an open source Web Manager for Institutions with a …5.4
• CVE-2025-27419WeGIA is an open source Web Manager for Institutions with a …7.5
• CVE-2025-2742A vulnerability classified as critical was found in zhijiant…8.1
• CVE-2025-27420WeGIA is an open source Web Manager for Institutions with a …5.4
• CVE-2025-27421Abacus is a highly scalable and stateless counting API. A cr…7.5
• CVE-2025-27422FACTION is a PenTesting Report Generation and Collaboration …7.5
• CVE-2025-27424Websites redirecting to a non-HTTP scheme URL could allow a …4.3
• CVE-2025-27425Scanning certain QR codes that included text with a website …4.3
• CVE-2025-27426Malicious websites utilizing a server-side redirect to an in…5.4
• CVE-2025-27427A vulnerability exists in Apache ActiveMQ Artemis whereby a …4.3
• CVE-2025-27428Due to directory traversal vulnerability, an authorized atta…7.7
• CVE-2025-27429SAP S/4HANA allows an attacker with user privileges to explo…9.9