Executive brief
A vulnerability in the Vim text editor allows an attacker to execute malicious commands on a user's computer simply by tricking them into opening a specially crafted file. This occurs because Vim fails to properly restrict certain configuration settings within files, allowing them to bypass security sandboxes. An exploit could lead to full system compromise, data theft, or unauthorized access to the user's files and operations.
Technical details
A vulnerability chain in Vim exists where the 'tabpanel' option lacks the P_MLE flag, allowing it to be set via a modeline to include a %{expr} expression without requiring 'modelineexpr' to be enabled. While Vim attempts to evaluate this expression within a sandbox, the autocmd_add() function lacks a check_secure() call, allowing sandboxed code to register an autocommand. This autocommand can then execute arbitrary OS commands with full privileges once the sandbox is exited. The vulnerability affects Vim versions from 9.1.1391 up to 9.2.0272 and is fixed in patch 9.2.0272.
Affected products
- Vim Vim from 9.1.1391 before 9.2.0272
Timeline
- 2026-03-30: disclosed: Initial disclosure on oss-security and GitHub Advisory
- 2026-03-30: patched: Vim patch 9.2.0272 released
- 2026-03-30: advisory
References
- https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d600815ec1f43459
- https://github.com/vim/vim/releases/tag/v9.2.0272
- https://github.com/vim/vim/security/advisories/GHSA-2gmj-rpqf-pxvh
- https://www.openwall.com/lists/oss-security/2026/03/30/3
- http://www.openwall.com/lists/oss-security/2026/04/02/4
- http://www.openwall.com/lists/oss-security/2026/04/02/5
- http://www.openwall.com/lists/oss-security/2026/04/03/6