{"api_version":"1","generated_at":"2026-07-23T12:23:03+00:00","cve":"CVE-2018-11319","urls":{"html":"https://cve.report/CVE-2018-11319","api":"https://cve.report/api/cve/CVE-2018-11319.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-11319","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-11319"},"summary":{"title":"CVE-2018-11319","description":"Syntastic (aka vim-syntastic) through 3.9.0 does not properly handle searches for configuration files (it searches the current directory up to potentially the root). This improper handling might be exploited for arbitrary code execution via a malicious gcc plugin, if an attacker has write access to a directory that is a parent of the base directory of the project being checked. NOTE: exploitation is more difficult after 3.8.0 because filename prediction may be needed.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2018-05-20 20:29:00","updated_at":"2019-10-03 00:03:00"},"problem_types":["CWE-22"],"metrics":[],"references":[{"url":"https://bugs.debian.org/894736","name":"https://bugs.debian.org/894736","refsource":"MISC","tags":["Exploit","Issue Tracking","Third Party Advisory"],"title":"#894736 - vim-syntastic: CVE-2018-11319: Checker config files allow arbitrary code execution scenarios - Debian Bug report logs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00036.html","name":"[debian-lts-announce] 20180726 [SECURITY] [DLA 1444-1] vim-syntastic security update","refsource":"MLIST","tags":["Mailing List","Third Party Advisory"],"title":"[SECURITY] [DLA 1444-1] vim-syntastic security update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.debian.org/security/2018/dsa-4261","name":"DSA-4261","refsource":"DEBIAN","tags":["Third Party Advisory"],"title":"Debian -- Security Information -- DSA-4261-1 vim-syntastic","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/vim-syntastic/syntastic/issues/2170","name":"https://github.com/vim-syntastic/syntastic/issues/2170","refsource":"MISC","tags":["Exploit","Issue Tracking","Third Party Advisory"],"title":"Checker config files allow arbitrary code execution scenarios · Issue #2170 · vim-syntastic/syntastic · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/vim-syntastic/syntastic/commit/6d7c0b394e001233dd09ec473fbea2002c72632f","name":"https://github.com/vim-syntastic/syntastic/commit/6d7c0b394e001233dd09ec473fbea2002c72632f","refsource":"MISC","tags":["Patch","Third Party Advisory"],"title":"Security: clear defaults for config file names (cf. #2170). · vim-syntastic/syntastic@6d7c0b3 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-11319","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11319","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"11319","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"11319","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"11319","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"11319","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"11319","vulnerable":"1","versionEndIncluding":"3.9.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"syntastic_project","cpe5":"syntastic","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"vim","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2018-11319","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Syntastic (aka vim-syntastic) through 3.9.0 does not properly handle searches for configuration files (it searches the current directory up to potentially the root). This improper handling might be exploited for arbitrary code execution via a malicious gcc plugin, if an attacker has write access to a directory that is a parent of the base directory of the project being checked. NOTE: exploitation is more difficult after 3.8.0 because filename prediction may be needed."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"DSA-4261","refsource":"DEBIAN","url":"https://www.debian.org/security/2018/dsa-4261"},{"name":"https://github.com/vim-syntastic/syntastic/commit/6d7c0b394e001233dd09ec473fbea2002c72632f","refsource":"MISC","url":"https://github.com/vim-syntastic/syntastic/commit/6d7c0b394e001233dd09ec473fbea2002c72632f"},{"name":"[debian-lts-announce] 20180726 [SECURITY] [DLA 1444-1] vim-syntastic security update","refsource":"MLIST","url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00036.html"},{"name":"https://github.com/vim-syntastic/syntastic/issues/2170","refsource":"MISC","url":"https://github.com/vim-syntastic/syntastic/issues/2170"},{"name":"https://bugs.debian.org/894736","refsource":"MISC","url":"https://bugs.debian.org/894736"}]}},"nvd":{"publishedDate":"2018-05-20 20:29:00","lastModifiedDate":"2019-10-03 00:03:00","problem_types":["CWE-22"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:C/I:C/A:C","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE","baseScore":8.5},"severity":"HIGH","exploitabilityScore":6.8,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:syntastic_project:syntastic:*:*:*:*:*:vim:*:*","versionEndIncluding":"3.9.0","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"11319","Ordinal":"127794","Title":"CVE-2018-11319","CVE":"CVE-2018-11319","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"11319","Ordinal":"1","NoteData":"Syntastic (aka vim-syntastic) through 3.9.0 does not properly handle searches for configuration files (it searches the current directory up to potentially the root). This improper handling might be exploited for arbitrary code execution via a malicious gcc plugin, if an attacker has write access to a directory that is a parent of the base directory of the project being checked. NOTE: exploitation is more difficult after 3.8.0 because filename prediction may be needed.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"11319","Ordinal":"2","NoteData":"2018-05-20","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"11319","Ordinal":"3","NoteData":"2018-08-04","Type":"Other","Title":"Modified"}]}}}