The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted…
Priority MEDIUM 47CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-78.
Summary
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a tar archive and possibly (2) the filename of the first file in a tar archive, which is not properly handled by the VIM TAR plugin (tar.vim) v.10 through v.22, as demonstrated by the shellescape, tarplugin.v2, tarplugin, and tarplugin.updated test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3075. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.
Why it matters now
EPSS 0.03841 90th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 18
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vim:tar.vim:v.10:*:*:*:*:*:*:* | v.10 | Vulnerable | vim |
| cpe:2.3:a:vim:tar.vim:v.11:*:*:*:*:*:*:* | v.11 | Vulnerable | vim |
| cpe:2.3:a:vim:tar.vim:v.12:*:*:*:*:*:*:* | v.12 | Vulnerable | vim |
| cpe:2.3:a:vim:tar.vim:v.13:*:*:*:*:*:*:* | v.13 | Vulnerable | vim |
| cpe:2.3:a:vim:tar.vim:v.14:*:*:*:*:*:*:* | v.14 | Vulnerable | vim |
| cpe:2.3:a:vim:tar.vim:v.15:*:*:*:*:*:*:* | v.15 | Vulnerable | vim |
| cpe:2.3:a:vim:tar.vim:v.16:*:*:*:*:*:*:* | v.16 | Vulnerable | vim |
| cpe:2.3:a:vim:tar.vim:v.17:*:*:*:*:*:*:* | v.17 | Vulnerable | vim |
| cpe:2.3:a:vim:tar.vim:v.18:*:*:*:*:*:*:* | v.18 | Vulnerable | vim |
| cpe:2.3:a:vim:tar.vim:v.19:*:*:*:*:*:*:* | v.19 | Vulnerable | vim |
- cpe:2.3:a:vim:tar.vim:v.10:*:*:*:*:*:*:* Versions v.10 Vulnerable ·vim
- cpe:2.3:a:vim:tar.vim:v.11:*:*:*:*:*:*:* Versions v.11 Vulnerable ·vim
- cpe:2.3:a:vim:tar.vim:v.12:*:*:*:*:*:*:* Versions v.12 Vulnerable ·vim
- cpe:2.3:a:vim:tar.vim:v.13:*:*:*:*:*:*:* Versions v.13 Vulnerable ·vim
- cpe:2.3:a:vim:tar.vim:v.14:*:*:*:*:*:*:* Versions v.14 Vulnerable ·vim
- cpe:2.3:a:vim:tar.vim:v.15:*:*:*:*:*:*:* Versions v.15 Vulnerable ·vim
- cpe:2.3:a:vim:tar.vim:v.16:*:*:*:*:*:*:* Versions v.16 Vulnerable ·vim
- cpe:2.3:a:vim:tar.vim:v.17:*:*:*:*:*:*:* Versions v.17 Vulnerable ·vim
- cpe:2.3:a:vim:tar.vim:v.18:*:*:*:*:*:*:* Versions v.18 Vulnerable ·vim
- cpe:2.3:a:vim:tar.vim:v.19:*:*:*:*:*:*:* Versions v.19 Vulnerable ·vim
Show 8 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vim:tar.vim:v.20:*:*:*:*:*:*:* | v.20 | Vulnerable | vim |
| cpe:2.3:a:vim:tar.vim:v.21:*:*:*:*:*:*:* | v.21 | Vulnerable | vim |
| cpe:2.3:a:vim:tar.vim:v.22:*:*:*:*:*:*:* | v.22 | Vulnerable | vim |
| cpe:2.3:a:vim:vim:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | vim |
| cpe:2.3:a:vim:vim:7.1:*:*:*:*:*:*:* | 7.1 | Vulnerable | vim |
| cpe:2.3:a:vim:vim:7.1.266:*:*:*:*:*:*:* | 7.1.266 | Vulnerable | vim |
| cpe:2.3:a:vim:vim:7.1.314:*:*:*:*:*:*:* | 7.1.314 | Vulnerable | vim |
| cpe:2.3:a:vim:vim:7.2:*:*:*:*:*:*:* | 7.2 | Vulnerable | vim |
- cpe:2.3:a:vim:tar.vim:v.20:*:*:*:*:*:*:* Versions v.20 Vulnerable ·vim
- cpe:2.3:a:vim:tar.vim:v.21:*:*:*:*:*:*:* Versions v.21 Vulnerable ·vim
- cpe:2.3:a:vim:tar.vim:v.22:*:*:*:*:*:*:* Versions v.22 Vulnerable ·vim
- cpe:2.3:a:vim:vim:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·vim
- cpe:2.3:a:vim:vim:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·vim
- cpe:2.3:a:vim:vim:7.1.266:*:*:*:*:*:*:* Versions 7.1.266 Vulnerable ·vim
- cpe:2.3:a:vim:vim:7.1.314:*:*:*:*:*:*:* Versions 7.1.314 Vulnerable ·vim
- cpe:2.3:a:vim:vim:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·vim
Remediation
Red Hat 1 advisory
- RHSA-2008:0580 Released 2008-11-25 · Red Hat rating Moderatevim security update
- Red Hat Enterprise Linux (v. 5 server) vim-2:7.0.109-4.el5_2.4z, vim-X11-2:7.0.109-4.el5_2.4z, vim-X11-2:7.0.109-4.el5_2.4z.i386 +14
- Red Hat Enterprise Linux Desktop (v. 5 client) vim-2:7.0.109-4.el5_2.4z, vim-X11-2:7.0.109-4.el5_2.4z, vim-X11-2:7.0.109-4.el5_2.4z.i386 +6
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2008:0580 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2008:0580 |
Timeline
- 2026-10-02 Threatist record created from CVE-2008-3074
- 2026-10-03 Alias added: GHSA-rj5h-39v8-hch3
- 2026-10-19 EPSS moved to the 90th–95th percentile
References
Exploit 2
Other 14
- [oss-security] 20080715 Re: Re: More arbitrary code executions in Netrw
- [oss-security] 20081020 CVE request (vim)
- oval:org.mitre.oval:def:10754
- [oss-security] 20080713 Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
- [oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
- [oss-security] 20080731 Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324
- 20080701 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1
- [oss-security] 20080708 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919
- [oss-security] 20080710 Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
- http://www.rdancer.org/vulnerablevim-shellescape.html
- https://bugzilla.redhat.com/show_bug.cgi?id=467428
- [oss-security] 20081015 Vim CVE issues cleanup (plugins tar.vim, zip.vim) - CVE-2008-3074 and CVE-2008-3075
Sources
- CVE-2008-3074 · CVE Program
- CVE-2008-3074 · NVD
- FIRST EPSS
- GHSA-rj5h-39v8-hch3 · GitHub Advisory Database · CC BY 4.0
- CVE-2008-3074 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences