I do not know if this question should be asked here or not. In almost every language, malware exists. Is the same also applicable for vimscript?Suppose vim is running with high system privileges. Is there any possibility that a new vim user could ruin up his/her system by using a plugin or nice looking vimrc file (i.e., so-called malicious scripts in other scripting languages)?What are the measures that a new user can take care of before running unknown script files? I know that disabling scripts is a obvious solution to that. But there are a really good number of plugins which are quite useful, even for the new learners.Again to say, this question might not fit here, but I do believe that security is also very important part of the entire picture.Pointing to some resources or info regarding this would be very much helpful for the new vim users like me.
How safe is it to use an unknown `_vimrc` or `vimscript` file?
vimscript;vimrc;plugin system;security
Well, Vim can execute arbitrary commands with :!. It can set environment variables. Malware scripts that are shell scripts can, therefore, be run from Vimscript.It can make use of complex Perl, Python, Ruby or Lua programs. So malware written in any of these that makes use of only standard libraries could be embedded in Vim.Even if neither of these were true, Vim is an editor. If run as root, we could easily edit your /etc/passwd and /etc/shadow files to create a new user and /etc/sudoers to grant them complete sudo privileges, and a cronjob to run shell scripts to set this user up.As with executing random scripts off the internet, there's no easy way to be safe. In Linux, you could run in a VM with an overlay might tell you what files a given vimrc modifies. It depends on how much risk you perceive.