I could create a web page with the following code, using HTML span elements and CSS to hide the middle part of the text so that only
ls -la is visible to the casual viewer (not viewing the source). Note: the
^[ is the Escape character and the
^M is the carriage return character.
ls ^[:echom "This could be a silent command."^Mi -la
If you were already in Insert mode and pasted this text into Vim, you would see
ls -la but if you run the
:messages command, you can see the results of the hidden Vim command.
I've tried this with both Vim 7.4 on a Linux terminal and GVim 8 on Windows and in both cases, the attack was successful. There may be other attack vectors but this was something I quickly came up with.
To defend against this attack it's best to stay in Normal mode and to paste using
"+p. In Normal mode, when putting text from a register, the full text (including the hidden part) is pasted. This same doesn't happe in Insert mode (even if
:set paste) has been set.
BTW, I keep meaning to configure bracketed paste mode in my terminal emulator to protect my shell from this attack. Your question has spurred me on do this.