{"cve":"CVE-2008-2712","nvd":{"published":"2008-06-16T21:41:00.000","modified":"2026-06-16T22:54:17.130","status":"Modified","description":"Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (3) xpm.vim, (4) gzip_vim, and (5) netrw.  NOTE: the originally reported version was 7.1.314, but the researcher actually found this set of issues in 7.1.298.  NOTE: the zipplugin issue (originally vector 2 in this identifier) has been subsumed by CVE-2008-3075.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-20"],"references":["http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html","http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html","http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html","http://marc.info/?l=bugtraq&m=121494431426308&w=2","http://secunia.com/advisories/30731"],"products":["canonical:ubuntu_linux","vim:vim"],"source":"nvd","synced_at":"2026-10-19T19:51:11.071189229+00:00"},"epss":{"cve":"CVE-2008-2712","score":0.15044,"percentile":0.96726,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}