UnratedFix available
vim — security advisory
vim 6.0 and 6.1, and possibly other versions, allows attackers to execute arbitrary commands using the libcall feature in modelines, which are not sandboxed but may be executed when vim is used to edit a malicious file, as demonstrated using mutt.
- Products
- vim
- Affected versions
- Not specified
- Fixed versions
- 6.1.263-1
- CVEs
- CVE-2002-1377
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 20:09 UTC · Revision 1
Source evidence
vim 6.0 and 6.1, and possibly other versions, allows attackers to execute arbitrary commands using the libcall feature in modelines, which are not sandboxed but may be executed when vim is used to edit a malicious file, as demonstrated using mutt.
osv:DEBIAN-CVE-2002-1377
vim
Fixed versions: 6.1.263-1
vim
Fixed versions: 6.1.263-1
vim
Fixed versions: 6.1.263-1
Complete source record
{
"id": "69335b06d8087bc6ca72536547e776ae38e9a4475386ce8e4bf93ee9371a49f4",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2002-1377",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2002-1377",
"summary": "vim 6.0 and 6.1, and possibly other versions, allows attackers to execute arbitrary commands using the libcall feature in modelines, which are not sandboxed but may be executed when vim is used to edit a malicious file, as demonstrated using mutt.",
"evidence": "osv:DEBIAN-CVE-2002-1377",
"products": [
{
"name": {
"value": "vim",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.1.263-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.1.263-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.1.263-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2002-1377",
"aliases": [
"DEBIAN-CVE-2002-1377"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.1.263-1"
}
]
}
],
"package": {
"name": "vim",
"purl": "pkg:deb/debian/vim?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2002-1377.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.1.263-1"
}
]
}
],
"package": {
"name": "vim",
"purl": "pkg:deb/debian/vim?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2002-1377.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.1.263-1"
}
]
}
],
"package": {
"name": "vim",
"purl": "pkg:deb/debian/vim?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2002-1377.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-22T23:47:19.685336304Z",
"provider": "osv",
"upstream": [
"CVE-2002-1377"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2002-1377"
]
},
"related_cves": [
{
"value": "CVE-2002-1377",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 410228,
"published_at": "2002-12-23T05:00:00+00:00"
}