CVE-2019-12735

HIGH

Vim < 8.1.1365 / Neovim < 0.3.6 - Arbitrary Code Execution

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-12735 has a selected CVSS score of 8.6 (high); EIP currently links 1 catalogued exploit, 5 repository PoCs, and 2 lab environments.

Description

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
5
Lab environments
2

Proofs of concept

6

Catalogued exploits

ExploitDBVim < 8.1.1365 / Neovim < 0.3.6 - Arbitrary Code ExecutionExploitDB exploitby ArminiusNot analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubpcy190/ace-vim-neovimRepository PoCby pcy1909Not analyzed3 files

418 B

GitHub
PoC details
GitHuboldthree3/CVE-2019-12735-VIM-NEOVIMRepository PoCby oldthree32Not analyzed3 files

1.0 KiB

GitHub
PoC details
GitHubdatntsec/CVE-2019-12735Repository PoCby datntsec0Not analyzed1 file

6.4 KiB

GitHub
PoC details
GitHubnickylimjj/cve-2019-12735Repository PoCby nickylimjj1Not analyzed4 files

2.7 KiB

GitHub
PoC details
GitHubst9007a/CVE-2019-12735Repository PoCby st9007a0Not analyzed9 files

1.9 KiB

GitHub
PoC details

Docker lab environments

2
GitHub

Repository root

st9007a/CVE-2019-12735Created Vuln labCVE-2019-12735Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker environment based on Ubuntu 20.04 that builds Vim 8.1.1364 from source and copies in demonstration files for CVE-2019-12735, a modeline command injection vulnerability.

Dockerfile:1-15README.md:1-44

Lab assessment

Vulnerability lab

The README explicitly references CVE-2019-12735, provides proof-of-concept steps, and the Dockerfile builds a vulnerable Vim version (v8.1.1364) to demonstrate the modeline command injection.

README.md:1-3Dockerfile:9
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

environment builder

Defines the container image: starts from ubuntu:20.04, installs build tools and netcat, clones Vim, checks out vulnerable tag v8.1.1364, builds and installs Vim, and copies the local directory into /root.

Dockerfile:1-15

.bashrc

shell alias

Sets alias vi=vim so that invoking vi runs the installed Vim.

.bashrc:1

.vimrc

Vim configuration

Enables modeline processing and sets backspace options, making Vim parse modelines in opened files.

.vimrc:1-2

demo1.txt

proof-of-concept payload

Contains a modeline that executes 'uname -a' via the :! command when Vim opens the file with modeline enabled.

demo1.txt:1

demo2.txt

reverse shell payload

Contains a modeline that sets up a reverse shell to 127.0.0.1:9999 using netcat and a named pipe.

demo2.txt:1

make_demo3.c

payload generator

C program that writes demo3.txt containing a modeline with a reverse shell payload to 127.0.0.1:9999, using escape sequences to hide the payload.

make_demo3.c:1-11

modeline_demo.py

modeline example

A Python file containing a Vim modeline comment that sets expandtab, softtabstop, and shiftwidth options.

modeline_demo.py:1

README.md

documentation

Explains CVE-2019-12735, provides proof-of-concept and remote shell steps, and references external exploit resources.

README.md:1-44
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2019-12735

Supported by supplied evidence

The README states the CVE was fixed after Vim 8.1.1365, and the Dockerfile checks out v8.1.1364, a vulnerable version. The provided payloads exploit modeline command injection, consistent with the CVE description.

README.md:1-3Dockerfile:9demo1.txt:1
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build the image.Dockerfile:1-15
  • The container must be run interactively with a shell (e.g., bash) to execute vim commands.README.md:7-9
  • For the reverse shell demos, a netcat listener must be started on the host or another container session on port 9999.README.md:15-18

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile.Dockerfile:1-15
  2. Run a container from the image and start an interactive shell.README.md:7-9
  3. For the proof-of-concept, execute 'vim demo1.txt' to trigger the uname command.README.md:7-9
  4. For the remote shell, compile make_demo3.c, run it to generate demo3.txt, start a netcat listener in another session, then open demo3.txt with vim.README.md:13-25
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All payloads target the local container (127.0.0.1) and are explicitly documented as part of the vulnerability demonstration. No evidence of host escape, external connectivity, persistence, or hidden malicious behavior is present.

demo1.txt:1demo2.txt:1make_demo3.c:5README.md:1-44
Review boundaries

What the analysis did not establish

  • No Docker Compose file or runtime configuration (e.g., port mappings, privileged mode) is provided; the packet only contains the Dockerfile and supporting files.
  • The packet does not include a pre-built image or evidence of actual execution; analysis is based solely on static file contents.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

Repository root

nickylimjj/cve-2019-12735Created Vuln labCVE-2019-12735Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile builds an Ubuntu 20.04 container with a vulnerable version of Vim (8.1.1364) and a proof-of-concept exploit file. The README states it is a study environment for CVE-2019-12735.

Dockerfile:1-15README.md:1-2

Lab assessment

Vulnerability lab

The README explicitly states the repository is for studying the exploitation of CVE-2019-12735. The Dockerfile installs a vulnerable Vim version (8.1.1364) and creates a proof-of-concept file that triggers the vulnerability.

README.md:1-2Dockerfile:5-6Dockerfile:12-14
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

builds the lab environment

Defines an Ubuntu 20.04 image, installs build tools, downloads and compiles Vim 8.1.1364, creates a non-root user, and writes a proof-of-concept exploit file.

Dockerfile:1-15

README.md

documents the lab purpose and usage

Describes the lab as a Docker image for studying CVE-2019-12735 exploitation, lists affected software, provides build/run/attach instructions, and credits inspiration.

README.md:1-26
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2019-12735

Supported by supplied evidence

The README explicitly associates the lab with CVE-2019-12735. The Dockerfile installs Vim 8.1.1364, which is within the affected range (<8.1.1365) stated in the README, and creates a proof-of-concept file that triggers the modeline vulnerability.

README.md:1-2README.md:5-6Dockerfile:5-6Dockerfile:12-14
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed on the host to build and run the container.README.md:9-12
  • The host must have 'make' available to execute the Makefile targets (build, run, attach).README.md:10-12

Evidence-described exercise path

  1. Build the Docker image using 'make build'.README.md:10
  2. Run the container with 'make run'.README.md:11
  3. Attach to the running container using 'make attach'.README.md:12
  4. Inside the container, open the proof-of-concept file with 'vim exploit/poc.txt' to trigger the vulnerability.README.md:15
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile and README describe a self-contained vulnerability lab. The proof-of-concept command executes 'echo hacked; id; uname -a' inside the container, which is expected exploit demonstration behavior. No evidence of host escape, external connectivity, persistence, credential theft, or destructive actions beyond the lab target.

Dockerfile:12-14README.md:1-26
Review boundaries

What the analysis did not establish

  • The Makefile is not included in evidence_files, so exact run/attach commands (e.g., port mappings, volume mounts, privileged mode) are unknown.
  • The proof-of-concept command is hardcoded in the Dockerfile and does not show dynamic external payload retrieval, but its full effect depends on Vim's runtime behavior which is not inspected here.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

Showing 12 of 32