2 of 6 add proof of concept

Until very recently (thanks to Sato Katsura’s clarification), Vim was vulnerable to this kind of attack (while in Insert mode).

I could create a web page with the following code, using HTML span elements and CSS to hide the middle part of the text so that only ls -la is visible to the casual viewer (not viewing the source). Note: the ^[ is the Escape character and the ^M is the carriage return character. Since Stack Exchange protects against this sort of malicious hiding of CSS, I’ve quickly created and uploaded a proof of concept.

ls ^[:echom "This could be a silent command."^Mi -la

If you were already in Insert mode and pasted this text into Vim, you would see ls -la but if you run the :messages command, you can see the results of the hidden Vim command.

I’ve tried this with both Vim 7.4 on a Linux terminal and GVim 8 (with patches 1-2) on Windows and in both cases, the attack was successful. There may be other attack vectors but this was something I quickly came up with.

To defend against this attack it’s best to stay in Normal mode and to paste using "*p or "+p. In Normal mode, when putting text from a register, the full text (including the hidden part) is pasted. This same doesn’t happen in Insert mode (even if :set paste) has been set.

Of course, the best safeguard is to upgrade to a recent version that protects against this copy-paste attack. Sato Katsura has clarified that “Support for bracketed paste appeared in Vim 8.0.210, and was most recently fixed in version 8.0.303 (released on 2nd February 2017)”.

BTW, I keep meaning to configure bracketed paste mode in my terminal emulator to protect my shell from this attack. Your question has spurred me on do this.