Skip to main content

Vim CVE-2026-34982

| EUVD-2026-19313 HIGH
OS Command Injection (CWE-78)
2026-04-06 GitHub_M
Command Injection Vim
8.2
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
8.2 HIGH
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
SUSE
HIGH
qualitative
Red Hat
8.2 HIGH
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

4
Re-analysis Queued
Apr 22, 2026 - 20:22 vuln.today
cvss_changed
EUVD ID Assigned
Apr 06, 2026 - 15:30 euvd
EUVD-2026-19313
Analysis Generated
Apr 06, 2026 - 15:30 vuln.today
CVE Published
Apr 06, 2026 - 15:16 nvd
HIGH 8.2

DescriptionGitHub Advisory

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The complete, guitabtooltip and printheader options are missing the P_MLE flag, allowing a modeline to be executed. Additionally, the mapset() function lacks a check_secure() call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.

AnalysisAI

Arbitrary OS command execution in Vim prior to version 9.2.0276 occurs when users open maliciously crafted files containing modeline directives that bypass sandbox protections. The vulnerability exploits missing security flags on the complete, guitabtooltip, and printheader options, plus an unchecked mapset() function, enabling attackers to escape Vim's modeline sandbox and execute system commands. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Open crafted Vim file with malicious modeline
Exploit
Modeline executes due to missing P_MLE flag
Execution
mapset() function bypasses sandbox checks
Impact
Arbitrary OS command execution
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The victim must open a crafted file (with malicious modeline) in Vim versions prior to 9.2.0276. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 8.2 HIGH rating reflects significant impact potential (confidentiality and integrity both HIGH, scope CHANGED indicating container escape from sandbox) but critically depends on user interaction (UI:R) and local attack vector (AV:L requiring file delivery). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a seemingly innocuous text file (configuration file, code snippet, or documentation) containing malicious modeline directives that leverage the unsanitized complete, guitabtooltip, or printheader options combined with mapset() function calls to escape Vim's sandbox. When a developer clones a malicious Git repository and opens a README or source file in Vim, or when a system administrator reviews a log file delivered via support ticket, the modeline executes immediately upon file open without additional warnings. …
Remediation Immediately upgrade to Vim version 9.2.0276 or later, which includes commit 75661a66a1db1e1f3f1245c615 that adds P_MLE flags to the vulnerable options and implements check_secure() validation in mapset(). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory all Vim installations across engineering and operations teams; identify instances running versions prior to 9.2.0276. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More from same product – last 7 days

CVE-2026-47162 HIGH
7.3 Jun 11

Vimscript code injection in the netrw plugin shipped with Vim before 9.2.0495 allows attackers who can plant or have a v
CVE-2026-52859 MEDIUM
6.9 Jun 11

Out-of-bounds read in Vim's built-in terminal emulator (`:terminal` feature) prior to version 9.2.0565 allows a program

CVE-2026-47167 MEDIUM
5.1 Jun 11

Code injection via unsanitized step-definition patterns in Vim's cucumber filetype plugin allows arbitrary Ruby and shel

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.162 Affected
Container suse/sl-micro/6.0/toolbox:13.2-9.95 Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.91 Affected
Container suse/sle-micro-rancher/5.2:latest Affected
Container suse/sle-micro/5.2/toolbox:14.2-7.11.272 Affected

Share

CVE-2026-34982 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy