Arch Linux Security Advisory ASA-201611-29 ========================================== Severity: High Date : 2016-11-29 CVE-ID : CVE-2016-1248 Package : neovim Type : arbitrary command execution Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package neovim before version 0.1.7-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 0.1.7-1. # pacman -Syu "neovim>=0.1.7-1" The problem has been fixed upstream in version 0.1.7. Workaround ========== None. Description =========== A vulnerability has been discovered in vim which would allow arbitrary shell commands to be run if a user opened a file with a malicious modeline. This is due to lack of validation of values for a few options. Those options' values are then used in vim's scripts to build a command string that's evaluated by execute, which is what allows the shell commands to be run. This has been fixed in Vim by patch 8.0.0056. Since Neovim shares this code, it is also vulnerable. Impact ====== An attacker is able to execute arbitrary commands by tricking a user to open a malicious file with a special modeline. References ========== https://bugs.archlinux.org/task/51927 https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba7279... https://access.redhat.com/security/cve/CVE-2016-1248