CVE-2026-34982
Vim is an open source, command line text editor.
Published Apr 6, 2026 · updated Sep 18, 2026 · vim vim
Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The , and options are missing the flag, allowing a modeline to be executed. Additionally, the function lacks a call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 6, 2026 · NIST NVD
Detected
Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The , and options are missing the flag, allowing a modeline to be executed. Additionally, the function lacks a call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.
Sep 18, 2026 · NIST NVD
Updated
Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The , and options are missing the flag, allowing a modeline to be executed. Additionally, the function lacks a call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.
Affected
- cpe vim/vimversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-34982
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-34982
Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The , and options are missing the flag, allowing a
nvd.nist.gov