getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assertfails or nviminput in Neovim.
[
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2019-12735-4685cbf7",
"source": "https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040",
"digest": {
"length": 976.0,
"function_hash": "1746834675970572497654882864030739947"
},
"deprecated": false,
"target": {
"function": "openscript",
"file": "src/getchar.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2019-12735-6381ae2f",
"source": "https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040",
"digest": {
"line_hashes": [
"146200493773228420153804765641940418619",
"160854915955052030073365343100871021536",
"324317801429096001481274501501545490630",
"270572794309773631091151592016690264294"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "src/version.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2019-12735-641acf59",
"source": "https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040",
"digest": {
"line_hashes": [
"185363513821093602222151169292631684204",
"235144420480658108171554170543588031942",
"283444938912131467564733361560300264023",
"103359197891743278894976559825800879042"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "src/getchar.c"
}
}
]