CVSS 3.1
5.3 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LCVE-2019-20807
Medium (5.3). EPSS 0.5% chance of exploitation in the next 30 days.
In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
- CWE
- CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apple:mac_os_x
- canonical:ubuntu_linux
- debian:debian_linux
- opensuse:leap
- starwindsoftware:command_center
- starwindsoftware:san_\&_nas
- vim:vim
References
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00018.html
- http://seclists.org/fulldisclosure/2020/Jul/24
- https://github.com/vim/vim/commit/8c62a08faf89663e5633dc5036cd8695c80f1075
- https://github.com/vim/vim/releases/tag/v8.1.0881
- https://lists.debian.org/debian-lts-announce/2022/01/msg00003.html