CVE-2019-20807

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00018.htmlMailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Jul/24Mailing List, Third Party Advisory
https://github.com/vim/vim/commit/8c62a08faf89663e5633dc5036cd8695c80f1075Patch, Third Party Advisory
https://github.com/vim/vim/releases/tag/v8.1.0881Release Notes, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00003.htmlMailing List, Third Party Advisory
https://support.apple.com/kb/HT211289Third Party Advisory
https://usn.ubuntu.com/4582-1/Mailing List, Third Party Advisory
https://www.starwindsoftware.com/security/sw-20220812-0003/Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00018.htmlMailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Jul/24Mailing List, Third Party Advisory
https://github.com/vim/vim/commit/8c62a08faf89663e5633dc5036cd8695c80f1075Patch, Third Party Advisory
https://github.com/vim/vim/releases/tag/v8.1.0881Release Notes, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00003.htmlMailing List, Third Party Advisory
https://support.apple.com/kb/HT211289Third Party Advisory
https://usn.ubuntu.com/4582-1/Mailing List, Third Party Advisory
https://www.starwindsoftware.com/security/sw-20220812-0003/Third Party Advisory

Timeline

Published: May 28, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019