What’s Vulnerable › Vulnerabilities

CVE-2019-20807

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-05-28 · updated 2026-06-17
• Weakness: CWE-78

Description

In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).

Affected products

• macOS: 10.13.6, 10.14.6
• Canonical Ubuntu Linux: 16.04, 18.04
• Debian Linux: 9.0
• openSUSE Leap: 15.1
• Starwindsoftware Command Center: 2-build_6003
• Starwindsoftware San & Nas: 1.0-update_1
• vim/vim: before 8.1.0881 — fixed in 8.1.0881

How to fix

Upgrade to a fixed version: vim/vim 8.1.0881. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00018.html
• http://seclists.org/fulldisclosure/2020/Jul/24
• https://github.com/vim/vim/commit/8c62a08faf89663e5633dc5036cd8695c80f1075
• https://github.com/vim/vim/releases/tag/v8.1.0881
• https://lists.debian.org/debian-lts-announce/2022/01/msg00003.html
• https://support.apple.com/kb/HT211289
• https://usn.ubuntu.com/4582-1/
• https://www.starwindsoftware.com/security/sw-20220812-0003/
• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00018.html
• http://seclists.org/fulldisclosure/2020/Jul/24
• https://github.com/vim/vim/commit/8c62a08faf89663e5633dc5036cd8695c80f1075
• https://github.com/vim/vim/releases/tag/v8.1.0881

Get alerted when CVE-2019-20807 or the next vulnerability affects your stack