3 of 6 further clarification

Short answer: Vim is vulnerable to this kind of attack (while in Insert mode).

Proof of concept

I could create a web page with the following code, using HTML span elements and CSS to hide the middle part of the text so that only ls -la is visible to the casual viewer (not viewing the source). Note: the ^[ is the Escape character and the ^M is the carriage return character. Since Stack Exchange protects against this sort of malicious hiding of CSS, I’ve quickly created and uploaded a proof of concept.

ls ^[:echom "This could be a silent command."^Mi -la

If you were already in Insert mode and pasted this text into Vim, you would see ls -la but if you run the :messages command, you can see the results of the hidden Vim command.

I’ve tried this with both Vim 7.4 on a Linux terminal and GVim 8 (with patches 1-2) on Windows and in both cases, the attack was successful. There may be other attack vectors but this was something I quickly came up with.


To defend against this attack it’s best to stay in Normal mode and to paste using "*p or "+p. In Normal mode, when putting text from a register, the full text (including the hidden part) is pasted. This same doesn’t happen in Insert mode (even if :set paste) has been set.

Bracketed paste mode

Of course, the best safeguard is to upgrade to a recent version that protects against this copy-paste attack. Sato Katsura has clarified that “Support for bracketed paste appeared in Vim 8.0.210, and was most recently fixed in version 8.0.303 (released on 2nd February 2017)”.

Note: As I understand it, versions of Vim with support for bracketed paste mode should protect you when pasting using Ctrl-V (MS Windows), Command-V (Mac OS X), Shift-Insert or a mouse middle-click.

I’ll test from a GNU/Linux desktop machine later on but I’ve noticed that running Vim 8.0 (with patches 1-329) in Cygwin’s mintty terminal is still vulnerable to Insert-mode pasting when using Shift-Insert. Also, even with an up-to-date version of Vim, you’re still vulnerable if you paste from the * register while in Insert mode by typing (Ctrl-R*).


Use Normal mode when pasting text.