Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164

The version of vim installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-27423 advisory.

  - Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows     easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim     plugin uses the :read ex command line to append below the cursor position, however the is not sanitized     and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar     archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using     $SHELL). The issue has been fixed as of Vim patch v9.1.1164 (CVE-2025-27423)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of vim installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-27423 advisory.

  - Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows     easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim     plugin uses the :read ex command line to append below the cursor position, however the is not sanitized     and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar     archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using     $SHELL). The issue has been fixed as of Vim patch v9.1.1164 (CVE-2025-27423)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 2ec7816d-fdb7-11ef-91ff-b42e991fc52e advisory.

    security-advisories@github.com reports:
    Vim is distributed with the tar.vim plugin, that allows               easy editing and viewing of (compressed or uncompressed) tar               files.  Starting with 9.1.0858, the tar.vim plugin uses the               :read ex command line to append below the               cursor position, however the is not sanitized and is taken               literally from the tar archive.  This allows to execute               shellcommands via special crafted tar archives. Whether               this really happens, depends on the shell being used               ('shell' option, which is set using $SHELL).


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-6452f3da4b advisory.

    The newest upstream commit

    Security fix for CVE-2025-27423

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-027a373c31 advisory.

    The newest upstream commit

    Security fix for CVE-2025-27423

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows     easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim     plugin uses the :read ex command line to append below the cursor position, however the is not sanitized     and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar     archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using     $SHELL). The issue has been fixed as of Vim patch v9.1.1164 (CVE-2025-27423)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
233148	Azure Linux 3.0 Security Update: vim (CVE-2025-27423)	Nessus	Azure Linux Local Security Checks	high
232572	CBL Mariner 2.0 Security Update: vim (CVE-2025-27423)	Nessus	MarinerOS Local Security Checks	high
232562	FreeBSD : vim -- Improper Input Validation in Vim (2ec7816d-fdb7-11ef-91ff-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	high
232526	Fedora 40 : vim (2025-6452f3da4b)	Nessus	Fedora Local Security Checks	high
232206	Fedora 41 : vim (2025-027a373c31)	Nessus	Fedora Local Security Checks	high
232133	Linux Distros Unpatched Vulnerability : CVE-2025-27423	Nessus	Misc.	high

Detections

Analytics

CVE-2025-27423

high

Tenable Plugins

high

high

high

high

high

high