CVE-2025-27423 Improper Input Validation in Vim
Attackers can execute arbitrary shell commands by tricking users into opening maliciously crafted tar archives in Vim.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-27423?
CVE-2025-27423 is a high-severity command injection vulnerability in Netapp Hci Compute Node, published on 3 Mar 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164
Weakness: CWE-77
Which versions are affected by CVE-2025-27423?
It affects 2 products.
Products include Netapp Hci Compute Node, Vim Vim.
How do I fix CVE-2025-27423?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-27423 being exploited?
There is no known exploitation of CVE-2025-27423 in the wild and no public exploit code.
Other vulnerabilities in Netapp Hci Compute Node
Sources
Also known as ALPINE-CVE-2025-27423, AZL-57735, AZL-57746, BELL-CVE-2025-27423, DEBIAN-CVE-2025-27423, GHSA-wfmf-8626-q3r3 and 1 more.