Vim

The critical vulnerability identified in the Vim text editor, CVE-2025-27423, poses a high-severity threat by enabling arbitrary code execution through maliciously crafted TAR archives. Affected by this flaw are Vim versions prior to 9.1.1164, where an input validation failure in the tar.vim plugin could lead to potential command injection attacks. The impact of this vulnerability extends from individual users to broader development and production environments, potentially affecting CI/CD pipelines and automated system processes. Exploitation of this bug necessitates user interaction, such as opening a malicious TAR file, putting both local and system-wide security at risk.

Source: https://cybersecuritynews.com/vim-editor-vulnerability-exploited/

TPRM report: https://scoringcyber.rankiteo.com/company/getvim

"id": "get456030525",
"linkid": "getvim",
"type": "Vulnerability",
"date": "3/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Technology',
                        'name': 'Vim Text Editor Users',
                        'type': 'Software Users'}],
 'attack_vector': 'Maliciously crafted TAR archives',
 'description': 'The critical vulnerability identified in the Vim text editor, '
                'CVE-2025-27423, poses a high-severity threat by enabling '
                'arbitrary code execution through maliciously crafted TAR '
                'archives. Affected by this flaw are Vim versions prior to '
                '9.1.1164, where an input validation failure in the tar.vim '
                'plugin could lead to potential command injection attacks. The '
                'impact of this vulnerability extends from individual users to '
                'broader development and production environments, potentially '
                'affecting CI/CD pipelines and automated system processes. '
                'Exploitation of this bug necessitates user interaction, such '
                'as opening a malicious TAR file, putting both local and '
                'system-wide security at risk.',
 'impact': {'systems_affected': ['Vim versions prior to 9.1.1164',
                                 'Development and production environments',
                                 'CI/CD pipelines',
                                 'Automated system processes']},
 'initial_access_broker': {'entry_point': 'Maliciously crafted TAR archives'},
 'post_incident_analysis': {'root_causes': 'Input validation failure in the '
                                           'tar.vim plugin'},
 'title': 'Vim Text Editor Critical Vulnerability',
 'type': 'Vulnerability',
 'vulnerability_exploited': 'CVE-2025-27423'}