1 of 6

I could create a web page with the following code, using HTML span elements and CSS to hide the middle part of the text so that only ls -la is visible to the casual viewer (not viewing the source). Note: the ^[ is the Escape character and the ^M is the carriage return character.

ls ^[:echom "This could be a silent command."^Mi -la

If you were already in Insert mode and pasted this text into Vim, you would see ls -la but if you run the :messages command, you can see the results of the hidden Vim command.

I've tried this with both Vim 7.4 on a Linux terminal and GVim 8 on Windows and in both cases, the attack was successful. There may be other attack vectors but this was something I quickly came up with.

To defend against this attack it's best to stay in Normal mode and to paste using "*p or "+p. In Normal mode, when putting text from a register, the full text (including the hidden part) is pasted. This same doesn't happe in Insert mode (even if :set paste) has been set.

BTW, I keep meaning to configure bracketed paste mode in my terminal emulator to protect my shell from this attack. Your question has spurred me on do this.