Skip to main content

Vim CVE-2026-34982

| EUVDEUVD-2026-19313 HIGH
OS Command Injection (CWE-78)
2026-04-06 GitHub_M
Command Injection Vim
8.2
CVSS 3.1 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Open crafted Vim file with malicious modeline
  2. Exploit
    Modeline executes due to missing P_MLE flag
  3. Execution
    mapset() function bypasses sandbox checks
  4. Impact
    Arbitrary OS command execution

Vulnerability Assessment

Weakness
CWE
CWE-78
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK

2 techniques across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The victim must open a crafted file (with malicious modeline) in Vim versions prior to 9.2.0276. Requires local file access and user interaction. Attacker can execute arbitrary OS commands via missing sandbox escape in complete, guitabtooltip, printheader options or mapset() function.
Impact

The CVSS 8.2 HIGH rating reflects significant impact potential (confidentiality and integrity both HIGH, scope CHANGED indicating container escape from sandbox) but critically depends on user interaction (UI:R) and local attack vector (AV:L requiring file delivery). The low attack complexity (AC:L) and no privilege requirement (PR:N) mean any attacker who convinces a user to open a crafted file-via email attachment, repository clone, downloaded configuration, or shared document-can achieve command execution with the victim's privileges. However, no CISA KEV listing indicates this is not confirmed actively exploited in the wild at enterprise scale. The primary risk surfaces are development teams who routinely open untrusted code/config files, system administrators reviewing logs or scripts from untrusted sources, and users in environments where Vim handles file previews automatically. SSVC factors suggest moderate prioritization: exploitation requires social engineering (not automatable), technical impact is total system compromise in user context, but widespread opportunistic exploitation appears limited by the need for targeted file delivery. Organizations should prioritize patching if Vim is used to open files from external or untrusted sources.
Exploit ScenarioDerived

An attacker crafts a seemingly innocuous text file (configuration file, code snippet, or documentation) containing malicious modeline directives that leverage the unsanitized complete, guitabtooltip, or printheader options combined with mapset() function calls to escape Vim's sandbox. When a developer clones a malicious Git repository and opens a README or source file in Vim, or when a system administrator reviews a log file delivered via support ticket, the modeline executes immediately upon file open without additional warnings. The attacker achieves arbitrary command execution in the victim's user context, enabling data exfiltration, credential harvesting, lateral movement, or persistence mechanism installation. Because the attack vector is local (AV:L) and requires user interaction (UI:R), success depends on social engineering-disguising the malicious file as legitimate content within trusted workflows-but the low complexity (AC:L) means exploitation requires no specialized knowledge once the file is opened.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 06, 2026

Arbitrary OS command execution in Vim prior to version 9.2.0276 occurs when users open maliciously crafted files containing modeline directives that bypass sandbox protections. The vulnerability exploits missing security flags on the complete, guitabtooltip, and printheader options, plus an unchecked mapset() function, enabling attackers to escape Vim's modeline sandbox and execute system commands. Publicly available exploit code exists. With EPSS data unavailable and no CISA KEV listing, real-world exploitation risk depends heavily on social engineering success, though the low attack complexity (CVSS AC:L) and no authentication requirement (PR:N) lower the barrier for opportunistic attacks against users who routinely open untrusted files.

RemediationAI

Immediately upgrade to Vim version 9.2.0276 or later, which includes commit 75661a66a1db1e1f3f1245c615 that adds P_MLE flags to the vulnerable options and implements check_secure() validation in mapset(). Official release available at https://github.com/vim/vim/releases/tag/v9.2.0276. For Linux users, apply distribution-provided security updates using native package managers (apt, yum, dnf, pacman). macOS users should update via Homebrew (brew upgrade vim) or download patched MacVim builds. Windows users should obtain updated binaries from the official Vim website or trusted package managers like Chocolatey. For environments unable to upgrade immediately, disable modeline processing entirely by adding 'set nomodeline' to vimrc configuration files, though this removes legitimate modeline functionality and should be considered a temporary workaround only. Organizational policy should enforce that users do not open files from untrusted sources in Vim until patched, and security teams should prioritize systems where Vim handles automated file processing or previews.

Affected VersionsENISA

vim < 9.2.0276

Affected Packages

euvd vim fix: 9.2.0276

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Vim's modeline feature allows files to contain editor configuration directives (e.g., 'vim: set options') that execute when the file opens. To prevent malicious abuse, Vim implements a sandbox using the P_MLE (modeline-safe) flag on sensitive options and check_secure() calls for potentially dangerous functions. This vulnerability represents a CWE-78 OS command injection flaw where three options (complete, guitabtooltip, printheader) were improperly marked as modeline-safe despite accepting user-controlled input that flows to command execution contexts. Simultaneously, the mapset() function-which restores key mappings and can execute arbitrary expressions-lacked the mandatory check_secure() gate when invoked from sandboxed modeline contexts. The affected CPE cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* indicates all Vim installations prior to the patched commit are vulnerable, spanning Linux, macOS, Windows, and BSD distributions that package Vim.

Know when Vim gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 8.2 HIGH
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
SUSE HIGH
Red Hat 8.2 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

DescriptionCVE.org

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The complete, guitabtooltip and printheader options are missing the P_MLE flag, allowing a modeline to be executed. Additionally, the mapset() function lacks a check_secure() call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.

Executive ViewAI

Why It Matters

Vim versions prior to 9.2.0276 contain a critical arbitrary command execution vulnerability triggered by malicious file content, allowing attackers to bypass security protections and execute system commands without user authentication. Organizations where developers, system administrators, or content creators regularly open files from untrusted sources face immediate risk of workstation compromise and lateral movement into production environments.

Business Impact: High
Compensating Controls

Pending vendor-released patch availability: (1) Restrict user file-opening permissions to known-safe sources only; (2) Disable modeline functionality across all Vim instances via .vimrc configuration (set modeline=off); (3) Implement file-type allowlisting to prevent users from opening suspicious archives or documents; (4) Monitor and restrict Vim process spawning of system commands via endpoint detection and response (EDR) tools; (5) Apply principle of least privilege to user accounts and workstations.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

More in Vim

View all
CVE-2022-3520 CRITICAL POC
9.8 Dec 02

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. Rated critical severity (CVSS 9.8), this vuln
CVE-2022-0729 HIGH POC
8.8 Feb 23

Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this

CVE-2026-34714 HIGH POC
8.6 Mar 30

Code execution vulnerability in Vim before 9.2.0272 allows attackers to gain immediate arbitrary command execution upon

CVE-2019-12735 HIGH POC
8.6 Jun 05

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via th
CVE-2021-3968 HIGH POC
8.0 Nov 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 8.0), this vulnerability is remotely exploita
CVE-2022-1616 HIGH POC
7.8 May 07

Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. Rated high severity (CVSS 7.8), this vu
CVE-2022-1619 HIGH POC
7.8 May 08

Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. Rated high se
CVE-2021-4136 HIGH POC
7.8 Dec 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2021-3973 HIGH POC
7.8 Nov 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2021-3927 HIGH POC
7.8 Nov 05

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2022-2125 HIGH POC
7.8 Jun 19

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Rated high severity (CVSS 7.8), this vulnerability
CVE-2022-2126 HIGH POC
7.8 Jun 19

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Rated high severity (CVSS 7.8), this vulnerability is no a

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2020-9054 CRITICAL POC
9.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2016-3081 HIGH POC
8.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.162 Affected
Container suse/sl-micro/6.0/toolbox:13.2-9.95 Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.91 Affected
Container suse/sle-micro-rancher/5.2:latest Affected
Container suse/sle-micro/5.2/toolbox:14.2-7.11.272 Affected

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8171-1 ADVISORY https://vuldb.com/vuln/355559 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1347/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1387/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21118/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21124/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21132/ REF http://www.openwall.com/lists/oss-security/2026/04/01/1 REF https://access.redhat.com/errata/RHSA-2026:11389 REF https://access.redhat.com/errata/RHSA-2026:11509 REF https://access.redhat.com/errata/RHSA-2026:11510 REF https://access.redhat.com/errata/RHSA-2026:19073 REF https://access.redhat.com/errata/RHSA-2026:19224 REF https://access.redhat.com/errata/RHSA-2026:21275 REF https://access.redhat.com/errata/RHSA-2026:22634 REF https://access.redhat.com/errata/RHSA-2026:28049 REF https://access.redhat.com/errata/RHSA-2026:28050 REF https://access.redhat.com/errata/RHSA-2026:28133 REF https://access.redhat.com/errata/RHSA-2026:30078 REF https://access.redhat.com/errata/RHSA-2026:30087 REF https://access.redhat.com/errata/RHSA-2026:30088 REF https://access.redhat.com/errata/RHSA-2026:30089 REF https://access.redhat.com/errata/RHSA-2026:30900 REF https://access.redhat.com/errata/RHSA-2026:33453 REF https://access.redhat.com/errata/RHSA-2026:34476 REF https://access.redhat.com/errata/RHSA-2026:34477 REF https://access.redhat.com/errata/RHSA-2026:36004 REF https://access.redhat.com/errata/RHSA-2026:36005 REF https://access.redhat.com/errata/RHSA-2026:36006 REF https://access.redhat.com/errata/RHSA-2026:56786 REF https://access.redhat.com/errata/RHSA-2026:56853 REF https://access.redhat.com/errata/RHSA-2026:56911 REF https://access.redhat.com/errata/RHSA-2026:57402 REF https://access.redhat.com/errata/RHSA-2026:57483 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:59831 REF https://access.redhat.com/errata/RHSA-2026:60019 REF https://access.redhat.com/errata/RHSA-2026:65839 REF https://access.redhat.com/errata/RHSA-2026:68711 REF https://access.redhat.com/security/cve/CVE-2026-34982 REF https://bugzilla.redhat.com/show_bug.cgi?id=2455400 REF https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615 REF https://github.com/vim/vim/releases/tag/v9.2.0276 REF https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34982.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy