getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assertfails or nviminput in Neovim.
{ "vanir_signatures": [ { "digest": { "length": 976.0, "function_hash": "1746834675970572497654882864030739947" }, "source": "https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040", "signature_type": "Function", "target": { "function": "openscript", "file": "src/getchar.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2019-12735-4685cbf7" }, { "digest": { "line_hashes": [ "146200493773228420153804765641940418619", "160854915955052030073365343100871021536", "324317801429096001481274501501545490630", "270572794309773631091151592016690264294" ], "threshold": 0.9 }, "source": "https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040", "signature_type": "Line", "target": { "file": "src/version.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2019-12735-6381ae2f" }, { "digest": { "line_hashes": [ "185363513821093602222151169292631684204", "235144420480658108171554170543588031942", "283444938912131467564733361560300264023", "103359197891743278894976559825800879042" ], "threshold": 0.9 }, "source": "https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040", "signature_type": "Line", "target": { "file": "src/getchar.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2019-12735-641acf59" } ] }