I do not know if this question should be asked here or not. In almost every language, malware exists. Is the same also applicable for vimscript?

Suppose vim is running with high system privileges. Is there any possibility that a new vim user could ruin up his/her system by using a plugin or nice looking vimrc file (i.e., so-called malicious scripts in other scripting languages)?

What are the measures that a new user can take care of before running unknown script files? I know that disabling scripts is a obvious solution to that. But there are a really good number of plugins which are quite useful, even for the new learners.

Again to say, this question might not fit here, but I do believe that security is also very important part of the entire picture.

Pointing to some resources or info regarding this would be very much helpful for the new vim users like me.

  • 4
    Not running Vim (or anything) as root is your best bet. Assuming $EDITOR is set to vim, simply use $ sudo -e filename.
    – romainl
    Feb 17, 2016 at 8:33
  • 1
    Just in case you are running Vim as root (which you should not but it can happen), I'd recommend to have only a very rudimentary vimrc in /root/.vimrc. I usually just turn syntax highlighting on. The fancier your normal user vim setup, the more obvious it will be that you are running as root.
    – kba
    Feb 17, 2016 at 11:52
  • @romainl: thanks for your kind suggestion...i hope this is the most reasonable thing the new vim users should follow...
    – Cylian
    Feb 18, 2016 at 9:41
  • @kba: thanks for your kind opinion...it is also a very good option to try...
    – Cylian
    Feb 18, 2016 at 9:41

2 Answers 2


Well, Vim can execute arbitrary commands with :!. It can set environment variables. Malware scripts that are shell scripts can, therefore, be run from Vimscript.

It can make use of complex Perl, Python, Ruby or Lua programs. So malware written in any of these that makes use of only standard libraries could be embedded in Vim.

Even if neither of these were true, Vim is an editor. If run as root, we could easily edit your /etc/passwd and /etc/shadow files to create a new user and /etc/sudoers to grant them complete sudo privileges, and a cronjob to run shell scripts to set this user up.

As with executing random scripts off the internet, there's no easy way to be safe. In Linux, you could run in a VM with an overlay might tell you what files a given vimrc modifies. It depends on how much risk you perceive.

  • Thanks for your help...the answer is quite helpful...while in Linux, it is undoubtedly a brilliant idea. What I believe now, is without understanding the code it is simply not to use that at all...or at least for those unknown or lesser known scripts...
    – Cylian
    Feb 18, 2016 at 9:48
  • @mMontu: excellent info...why not you post this as an answer...i believe that much info, is at least give basic idea for a newbies to look out in the the unknown sources...thank you so much...you rock!!!
    – Cylian
    Feb 18, 2016 at 11:24
  • @Cylian good idea, thanks for being so kind.
    – mMontu
    Feb 18, 2016 at 11:38

Extending on muru's answer, you could inspect the code, specially as the plugin code is usually very short (the exceptions are some popular plugins, but by being popular they are safer -- you can expect that many others have reviewed the source).

You don't have to fully understand the code; it would is enough to look for "dangerous" commands:

  1. :! and system(): allows the execution of shell commands, thus could change your system
  2. :perldo, :python, :lua, :tcl, and :ruby: execute commands on different languages, which may contain system calls embedded
  3. :execute: this command executes a string as a command, so it can be use to conceal one of the previous commands (e.g.: in order to make harder to spot call system('malware') or perldo malware, someone could concatenate the string into a variable)
  4. function("MyFunc"): call function references -- accepts a variable as a parameter, thus allowing concealing of system()

You could also try running some plugin functions using 'secure' or sandbox to detect shell and external languages (perl, python, etc).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.