VDB
ALPINE-CVE-2019-12735
ALPINE-CVE-2019-12735
PUBLISHED
CVSS 8.600000381469727 HIGH
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.
Risk Scores
CVSS 3.0
8.600000381469727
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.10 | vim | 7.3.364-r0, 7.3.1136-r0, 7.3.112-r0 |
| Alpine:v3.21 | vim | 7.2.284-r0, 7.3.434-r0, 7.3.515-r0 |
| Alpine:v3.17 | vim | 7.3.206-r1, 8.0.0329-r0, 8.0.0460-r0 |
| Alpine:v3.20 | vim | 7.4.1831-r0, 0, 8.0.0348-r0 |
| Alpine:v3.22 | vim | 7.2.411-r0, 8.1.0829-r0, 8.0.1727-r0 |
| Alpine:v3.12 | vim | 7.2.394-r1, 7.2.394-r0, 7.2.411-r0 |
| Alpine:v3.15 | vim | 0, 7.4-r0, 8.1.1364-r0 |
| Alpine:v3.9 | vim | 7.4-r0, 8.1.0026-r0, 8.0.1300-r0 |
| Alpine:v3.14 | vim | 7.3.82-r0, 7.4-r3, 7.4.1225-r1 |
| Alpine:v3.18 | vim | 8.0.1424-r1, 0, 7.2.394-r0 |
| Alpine:v3.19 | vim | 7.4-r1, 7.4-r0, 7.3.82-r0 |
| Alpine:v3.13 | vim | 7.4.2028-r0, 7.2.394-r0, 7.3.206-r0 |
| Alpine:v3.23 | vim | 7.4.861-r0, 8.0.0187-r0, 8.1.1075-r0 |
| Alpine:v3.7 | vim | 8.0.1240-r0, 8.0.1171-r0, 8.0.1137-r0 |
| Alpine:v3.11 | vim | 7.3.659-r0, 7.3.754-r0, 7.3.82-r0 |
| Alpine:v3.8 | vim | 7.3.434-r0, 7.3.1136-r0, 7.3.112-r1 |
| Alpine:v3.16 | vim | 7.3.003-r0, 0, 7.3.112-r0 |
Timeline
- Jun 5, 2019 CVE Published
- Dec 3, 2025 CVE Updated
- Aug 8, 2026 Distribution Patch