UNKNOWNCVE-2026-34982

Vim modeline bypass via various options affects Vim < 9.2.0276

Platform

linux

Component

vim

Fixed in

9.2.0276

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.

How to fix

Actualice a la versión 9.2.0276 o superior para mitigar la vulnerabilidad. Esta actualización corrige un bypass del sandbox del modeline que podría permitir la ejecución de comandos arbitrarios en el sistema operativo.

Monitor your dependencies automatically

Get notified when new vulnerabilities affect your projects. Free forever.

Start free