CVE-2007-2438

Severity: high (CVSS 7.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-05-02 · updated 2026-06-16

Description

The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write files via modelines.

Affected products

Vim Development Group Vim: 7.0

References

http://attrition.org/pipermail/vim/2007-May/001614.html
http://marc.info/?l=vim-dev&m=117762581821298&w=2
http://marc.info/?l=vim-dev&m=117778983714029&w=2
http://osvdb.org/36250
http://secunia.com/advisories/25024
http://secunia.com/advisories/25159
http://secunia.com/advisories/25182
http://secunia.com/advisories/25255
http://secunia.com/advisories/25367
http://secunia.com/advisories/25432
http://secunia.com/advisories/26653
http://tech.groups.yahoo.com/group/vimannounce/message/178

Get alerted when CVE-2007-2438 or the next vulnerability affects your stack