$ cve CVE-2008-4101 JSON

CVE-2008-4101 EXPLOIT

9.3

HIGH · CVSS 2.0 · EPSS 9.2% (pctl 95)

Patch early

A public exploit exists.

Description

Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell commands by entering a K keystroke on a line that contains a ";" (semicolon) followed by a command, or execute arbitrary Ex commands by entering an argument after a (2) "Ctrl-]" (control close-square-bracket) or (3) "g]" (g close-square-bracket) keystroke sequence, a different issue than CVE-2008-2712.

Scoring

CVSS	9.3 (HIGH, v2.0)
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS	9.21% — more likely to be exploited than 95% of all CVEs
Weakness	CWE-20
On CISA KEV	no
Public exploit	yes
Published	2008-09-18
Last modified	2026-06-16

Affected (1)

Vendor	Product
vim	vim

Public exploits

Source	Title	Date
exploit-db	Vim 7.1.314 - Insufficient Shell Escaping Multiple Command Execution Vulnerabilities	2008-08-19

References

→ the Explorer · watch your stack · NVD