CVE-2026-34982: Vim modeline bypass via various options affects Vim < 9.2.0276
Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The complete, guitabtooltip and printheader options are missing the PMLE flag, allowing a modeline to be executed. Additionally, the mapset() function lacks a checksecure() call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.
Other sources
Vim modeline bypass via various options affects Vim < 9.2.0276
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vimto a version that resolves this vulnerability.Fixed in 9.2.0276Patch 9.2.0276 - Compensating control
For Vim versions affected ("Vim < 9.2.0276"), mitigate modeline sandbox bypass by preventing modelines from being processed when opening files (e.g., disable modelines / modeline support in your Vim configuration) until Vim 9.2.0276 or later is applied.