CVE-2026-34714: Vim code execution via tabpanel modeline escape and sandbox bypass

CVE-2026-34714 · Severity: critical · CVSS 9.2 · Published 2026-03-30

A vulnerability in the Vim text editor allows an attacker to execute malicious commands on a user's computer simply by tricking them into opening a specially crafted file. This occurs because Vim fails to properly restrict certain configuration settings within files, allowing them to bypass security sandboxes. An exploit could lead to full system compromise, data theft, or unauthorized access to the user's files and operations.

Technologies: Vim. Vendors: Vim.

Quick answers

Is CVE-2026-34714 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34714 being exploited in the wild.
How severe is CVE-2026-34714?
Critical severity, with a CVSS score of 9.2, published 30 March 2026.
Which products and versions are affected?
Vim from 9.1.1391 before 9.2.0272.
Is there a fix for CVE-2026-34714?
A patch was published on 2026-03-30: Vim patch 9.2.0272 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34714 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-34714?
Check whether you run Vim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability chain in Vim exists where the 'tabpanel' option lacks the P_MLE flag, allowing it to be set via a modeline to include a %{expr} expression without requiring 'modelineexpr' to be enabled. While Vim attempts to evaluate this expression within a sandbox, the autocmd_add() function lacks a check_secure() call, allowing sandboxed code to register an autocommand. This autocommand can then execute arbitrary OS commands with full privileges once the sandbox is exited. The vulnerability affects Vim versions from 9.1.1391 up to 9.2.0272 and is fixed in patch 9.2.0272.

Affected products

  • Vim Vim from 9.1.1391 before 9.2.0272

Timeline

  • 2026-03-30: disclosed: Initial disclosure on oss-security and GitHub Advisory
  • 2026-03-30: patched: Vim patch 9.2.0272 released
  • 2026-03-30: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.