vim reports:
+++ +Summary
+Potential code execution with tar.vim and special crafted tar files
+Description
+Vim is distributed with the tar.vim plugin, that allows easy + editing and viewing of (compressed or uncompressed) tar files.
+Since commit 129a844 (Nov 11, 2024 runtime(tar): Update tar.vim to + support permissions), the tar.vim plugin uses the ":read " ex command + line to append below the cursor position, however the is not sanitized + and is taken literaly from the tar archive. This allows to execute + shell commands via special crafted tar archives. Whether this really + happens, depends on the shell being used ('shell' option, which is set + using $SHELL).
+Impact
+Impact is high but a user must be convinced to edit such a file + using Vim which will reveal the filename, so a careful user may suspect + some strange things going on. +