CVE-2019-12735: neovim OS Command Injection

CVSS: 9.3v2.0HighModified

AliasesALPINE-CVE-2019-12735MGASA-2020-0082SUSE-SU-2019:14078-1+16 more

Published 05-06-2019Last modified 11-11-2025

Vulnerability summary

CVE-2019-12735 is a high (CVSS 9.3) OS Command Injection vulnerability in neovim. EPSS estimates a 18.96% chance of exploitation in the next 30 days, higher than 97.2% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

18.96%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2github, exploit-database

Advisory lineage

Upstream 0 · Downstream 4 · Related 3

DLA-1871-1 OPENSUSE-SU-2024:11081-1 OPENSUSE-SU-2024:11497-1 USN-4016-1

Timeline

05-06-2019
PublishedVulnerability first disclosed.
11-11-2025
Last modifiedVulnerability information updated.

Description

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.

CVSS metrics

6 scores · 5 sources · 3 versions

v3.15.3v3.08.6v2.09.3

EPSS trend

Probability

18.96%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

0.00 pp

From 18.96% on 18-09-2026

18-09-202618-10-2026

EPSS score

18.96%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

githubUnverified
Security
Maturity: poc
exploit-databaselocallinuxUnverified
Vim < 8.1.1365 / Neovim < 0.3.6 - Arbitrary Code Execution
Maturity: poc

Weaknesses

CWE · root cause

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Affected systems

Suse22 products

neovim&distro=SUSE Package Hub 15< 0.3.7-bp150.2.9.1 | < 0.3.1-bp150.2.6.1
neovim&distro=SUSE Package Hub 15 SP1< 0.3.7-bp151.3.3.1
vim&distro=SUSE Enterprise Storage 4< 7.4.326-17.3.1
vim&distro=SUSE Linux Enterprise Desktop 12 SP3< 7.4.326-17.3.1
vim&distro=SUSE Linux Enterprise Desktop 12 SP4< 7.4.326-17.3.1

Show all 22

Redhat12 products

vim< 2:7.4.160-6.el7_6 | < 2:8.0.1763-11.el8_0 | < 2:7.4.629-5.el6_10.2 | < 2:7.4.160-4.el7_5.1 | < 2:7.4.160-2.el7_4.1
vim-common< 2:7.4.160-6.el7_6 | < 2:8.0.1763-11.el8_0 | < 2:7.4.629-5.el6_10.2 | < 2:7.4.160-4.el7_5.1 | < 2:7.4.160-2.el7_4.1
vim-common-debuginfo< 2:8.0.1763-11.el8_0
vim-debuginfo< 2:7.4.160-6.el7_6 | < 2:8.0.1763-11.el8_0 | < 2:7.4.629-5.el6_10.2 | < 2:7.4.160-4.el7_5.1 | < 2:7.4.160-2.el7_4.1
vim-debugsource< 2:8.0.1763-11.el8_0

Show all 12

Opensuse4 products

neovim&distro=openSUSE Leap 15.0< 0.3.1-bp150.2.6.1 | < 0.3.7-lp151.2.7.1
neovim&distro=openSUSE Leap 15.1< 0.3.1-bp150.2.6.1 | < 0.3.7-lp151.2.7.1
vim&distro=openSUSE Leap 15.0< 8.0.1568-lp151.5.3.1
vim&distro=openSUSE Leap 15.1< 8.0.1568-lp151.5.3.1

Debian2 products

neovim< 0.3.4-3 | < 0.1.7-4+deb9u1
vim< 2:8.1.0875-4 | < 2:8.0.0197-4+deb9u2

Mageia2 products

neovim< 0.3.7-1.mga7
vim< 8.1.1048-1.1.mga7

Ubuntu2 products

neovim< 0.2.2-3ubuntu0.1~esm1
vim< 2:7.4.1689-3ubuntu1.3 | < 2:8.0.1453-1ubuntu1.1

Alpine1 product

vim< 8.1.1365-r0 | < 8.0.1359-r2 | < 8.1.1365

Neovim1 product

neovim< 0.3.6

Vim1 product

vim< 8.1.1365

9 vendors · 47 products

References

60 links

github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.mdExploitPatchThird Party AdvisoryREPORT
github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040PatchThird Party Advisory
github.com/neovim/neovim/pull/10082PatchThird Party Advisory
bugs.debian.org/930020Mailing ListThird Party Advisory
bugs.debian.org/930024Mailing ListThird Party Advisory
lists.fedoraproject.org/archives/…Vendor Advisory
usn.ubuntu.com/4016-1/Vendor Advisory
usn.ubuntu.com/4016-2/Vendor Advisory
www.securityfocus.com/bid/108724VDB Entry
lists.fedoraproject.org/archives/…Vendor Advisory

Show all 60 references

lists.opensuse.org/opensuse-security-announce/2019-06/msg00031.htmlVendor Advisory
lists.opensuse.org/opensuse-security-announce/2019-06/msg00036.htmlVendor Advisory
lists.opensuse.org/opensuse-security-announce/2019-06/msg00037.htmlVendor Advisory
www.debian.org/security/2019/dsa-4467Vendor Advisory
seclists.org/bugtraq/2019/Jun/33Mailing List
support.f5.com/csp/article/K93144355
access.redhat.com/errata/RHSA-2019:1619Vendor AdvisoryAdvisory
access.redhat.com/errata/RHSA-2019:1774Vendor AdvisoryAdvisory
access.redhat.com/errata/RHSA-2019:1793Vendor AdvisoryAdvisory
lists.opensuse.org/opensuse-security-announce/2019-07/msg00034.htmlVendor Advisory
lists.opensuse.org/opensuse-security-announce/2019-07/msg00050.htmlVendor Advisory
www.debian.org/security/2019/dsa-4487Vendor Advisory
seclists.org/bugtraq/2019/Jul/39Mailing List
access.redhat.com/errata/RHSA-2019:1947Vendor AdvisoryAdvisory
lists.debian.org/debian-lts-announce/2019/08/msg00003.htmlMailing List
lists.opensuse.org/opensuse-security-announce/2019-08/msg00075.htmlVendor Advisory
support.f5.com/csp/article/K93144355?utm_source=f5support&utm_medium=RSS
security.gentoo.org/glsa/202003-04Vendor Advisory
www.exploit-db.com/exploits/46973
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORAX Transferred
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORAX Transferred
support.f5.com/csp/article/K93144355?utm_source=f5support&amp%3Butm_medium=RSSX Refsource CONFIRMX Transferred
security.alpinelinux.org/vuln/CVE-2019-12735Advisory
advisories.mageia.org/MGASA-2020-0082.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=24929REPORT
lists.fedoraproject.org/archives/…WEB
www.suse.com/support/update/announcement/2019/suse-su-201914078-1/Advisory
bugzilla.suse.com/1137443REPORT
www.suse.com/security/cve/CVE-2019-12735WEB
www.suse.com/support/update/announcement/2019/suse-su-20191456-1/Advisory
www.suse.com/support/update/announcement/2019/suse-su-20191457-1/Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1718308REPORT
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1619.jsonAdvisory
access.redhat.com/security/cve/CVE-2019-12735REPORT
www.cve.org/CVERecord?id=CVE-2019-12735AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2019-12735AdvisoryOval
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1774.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1793.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1947.jsonAdvisory
ubuntu.com/security/CVE-2019-12735REPORT
ubuntu.com/security/notices/USN-4016-1Advisory
ubuntu.com/security/notices/USN-4016-2Advisory
ubuntu.com/security/notices/USN-4862-1Advisory
security-tracker.debian.org/tracker/CVE-2019-12735Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities