Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NSummary
CVE-2025-27423 is a high-severity Command Injection (CWE-77) vulnerability in Vim Vim. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Vim's tar.vim plugin, distributed with the editor and used for viewing or editing tar archives, contains a command injection vulnerability. Starting in patch 9.1.0858, the plugin passes unsanitized content from the archive directly into the ":read" ex command. An attacker-supplied filename or header within a crafted tar file can therefore be interpreted literally by the shell configured via Vim's 'shell' option, resulting in arbitrary command execution. The flaw is tracked as CWE-77 and carries a CVSS 7.1 rating reflecting local access, low complexity, and the need for user interaction.
An attacker can exploit the issue by delivering a malicious tar archive that the victim opens or views with Vim. When tar.vim processes the archive, the embedded payload executes under the privileges of the Vim process, potentially reading or modifying files and altering system state. Success depends on the victim's shell configuration and whether they interact with the archive inside Vim; no remote network access or elevated privileges are required.
The vulnerability was addressed in Vim patch 9.1.1164. Official remediation guidance and the corresponding commits are published in the Vim GitHub repository and the GitHub Security Advisory GHSA-wfmf-8626-q3r3; NetApp has also issued a related advisory (NTAP-20250502-0002) for affected products.
The associated EPSS score has remained flat at 0.0208 with no material increase since disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6012
Vulnerability Data
Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line…
more
to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.3V1.2.5V1.2.8V1.2.9
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover command-construction flaws before deployment.
Input validation directly stops construction of commands from untrusted data containing special elements.
Secure engineering principles include proper neutralization and safe command construction practices.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and neutralization that prevent command injection.
Runtime monitoring of software and data can detect anomalous command execution resulting from injection.
Identifying recorded vulnerabilities enables remediation of command-injection flaws before exploitation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards require proper escaping and parameterization of commands, directly eliminating CWE-77.
Security testing in development catches command-injection vulnerabilities before release.
Secure development life cycle mandates input validation and command construction practices that directly prevent command injection.
Application security requirements explicitly call for controls against injection flaws including command injection.
Secure architecture principles reduce the attack surface but do not prescribe the specific neutralization techniques needed.
Environment separation limits the blast radius of an exploited command injection but does not prevent the flaw itself.