Skip to main content

Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

© 2026 Mondoo, Inc.

Privacy Policy Terms of Service Imprint

Vulnerability Intelligence

Vulnerability IntelligenceCVE-2019-12735

CVE-2019-12735

HIGH8.6

getchar

Published Jun 5, 2019

Modified 3 months ago

Details

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.

References(33)

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00031.html

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00036.html

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00037.html

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00034.html

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00050.html

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00075.html

http://www.securityfocus.com/bid/108724

https://access.redhat.com/errata/RHSA-2019:1619

https://access.redhat.com/errata/RHSA-2019:1774

https://access.redhat.com/errata/RHSA-2019:1793

https://access.redhat.com/errata/RHSA-2019:1947

https://bugs.debian.org/930020

https://bugs.debian.org/930024

https://github.com/neovim/neovim/pull/10082

https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md

https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040

https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BMDSHTF754TITC6AQJPCS5IRIDMMIM7/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRIRBC2YRGKPAWVRMZS4SZTGGCVRVZPR/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2BMDSHTF754TITC6AQJPCS5IRIDMMIM7/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TRIRBC2YRGKPAWVRMZS4SZTGGCVRVZPR/

https://seclists.org/bugtraq/2019/Jul/39

https://seclists.org/bugtraq/2019/Jun/33

https://security.gentoo.org/glsa/202003-04

https://support.f5.com/csp/article/K93144355

CVSS Analysis

CVSS v3.0

8.6

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

Scope

ChangedS:C

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

8.6/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Ecosystems

Timeline

PublishedJun 5, 2019

ModifiedNov 11, 2025

CVE-2019-12735 | Mondoo Vulnerability Intelligence