Until very recently (thanks to Sato Katsura’s clarification), Vim was vulnerable to this kind of attack (while in Insert mode).
I could create a web page with the following code, using HTML span elements and CSS to hide the middle part of the text so that only
ls -la is visible to the casual viewer (not viewing the source). Note: the
^[ is the Escape character and the
^M is the carriage return character. Since Stack Exchange protects against this sort of malicious hiding of CSS, I’ve quickly created and uploaded a proof of concept.
ls ^[:echom "This could be a silent command."^Mi -la
If you were already in Insert mode and pasted this text into Vim, you would see
ls -la but if you run the
:messages command, you can see the results of the hidden Vim command.
I’ve tried this with both Vim 7.4 on a Linux terminal and GVim 8 (with patches 1-2) on Windows and in both cases, the attack was successful. There may be other attack vectors but this was something I quickly came up with.
To defend against this attack it’s best to stay in Normal mode and to paste using
"+p. In Normal mode, when putting text from a register, the full text (including the hidden part) is pasted. This same doesn’t happen in Insert mode (even if
:set paste) has been set.
Of course, the best safeguard is to upgrade to a recent version that protects against this copy-paste attack. Sato Katsura has clarified that “Support for bracketed paste appeared in Vim 8.0.210, and was most recently fixed in version 8.0.303 (released on 2nd February 2017)”.
BTW, I keep meaning to configure bracketed paste mode in my terminal emulator to protect my shell from this attack. Your question has spurred me on do this.