Log in Start free

Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M

CVE-2026-34982Vim modeline bypass via various options affects Vim < 9.2.0276

High 8.2

In plain English

A high-severity OS command injection in vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.5%top 60.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10vim-X112:9.1.083-9.el10_2.2ALSA-2026:19073
AlmaLinux:8vim-X112:8.0.1763-22.el8_10.3ALSA-2026:11509
AlmaLinux:9vim-X112:8.2.2637-23.el9_7.3ALSA-2026:11510
AlmaLinux:9vim-X112:8.2.2637-26.el9_8.4ALSA-2026:19224
AlmaLinux:10vim-common2:9.1.083-9.el10_2.2ALSA-2026:19073
AlmaLinux:8vim-common2:8.0.1763-22.el8_10.3ALSA-2026:11509
AlmaLinux:9vim-common2:8.2.2637-26.el9_8.4ALSA-2026:19224
AlmaLinux:9vim-common2:8.2.2637-23.el9_7.3ALSA-2026:11510
AlmaLinux:10vim-data2:9.1.083-9.el10_2.2ALSA-2026:19073
AlmaLinux:10vim-data2:9.1.083-6.el10_1.4ALSA-2026:11389
AlmaLinux:10vim-enhanced2:9.1.083-9.el10_2.2ALSA-2026:19073
AlmaLinux:8vim-enhanced2:8.0.1763-22.el8_10.3ALSA-2026:11509
AlmaLinux:9vim-enhanced2:8.2.2637-26.el9_8.4ALSA-2026:19224
AlmaLinux:9vim-enhanced2:8.2.2637-23.el9_7.3ALSA-2026:11510
AlmaLinux:10vim-filesystem2:9.1.083-9.el10_2.2ALSA-2026:19073
AlmaLinux:10vim-filesystem2:9.1.083-6.el10_1.4ALSA-2026:11389
AlmaLinux:8vim-filesystem2:8.0.1763-22.el8_10.3ALSA-2026:11509
AlmaLinux:9vim-filesystem2:8.2.2637-23.el9_7.3ALSA-2026:11510
AlmaLinux:9vim-filesystem2:8.2.2637-26.el9_8.4ALSA-2026:19224
AlmaLinux:10vim-minimal2:9.1.083-9.el10_2.2ALSA-2026:19073
AlmaLinux:8vim-minimal2:8.0.1763-22.el8_10.3ALSA-2026:11509
AlmaLinux:9vim-minimal2:8.2.2637-23.el9_7.3ALSA-2026:11510
AlmaLinux:9vim-minimal2:8.2.2637-26.el9_8.4ALSA-2026:19224
AlmaLinux:10xxd2:9.1.083-9.el10_2.2ALSA-2026:19073
Alpine:v3.23vim9.2.0280-r0ALPINE-CVE-2026-34982
Alpine:v3.24vim9.2.0280-r0ALPINE-CVE-2026-34982
Debian:12vimno fix listedDEBIAN-CVE-2026-34982
Debian:13vim2:9.1.1230-2+deb13u1DEBIAN-CVE-2026-34982
Debian:14vim2:9.2.0315-1DEBIAN-CVE-2026-34982
Rocky Linux:10vim2:9.1.083-6.el10_1.4RLSA-2026:11389
Rocky Linux:10vim2:9.1.083-9.el10_2.2RLSA-2026:19073
Rocky Linux:8vim2:8.0.1763-22.el8_10.3RLSA-2026:11509
Rocky Linux:9vim2:8.2.2637-26.el9_8.4RLSA-2026:19224
Rocky Linux:9vim2:8.2.2637-23.el9_7.3RLSA-2026:11510
Ubuntu:22.04:LTSvim2:8.2.3995-1ubuntu2.27UBUNTU-CVE-2026-34982
Ubuntu:24.04:LTSvim2:9.1.0016-1ubuntu7.11UBUNTU-CVE-2026-34982
Ubuntu:25.10vim2:9.1.0967-1ubuntu6.2UBUNTU-CVE-2026-34982

Affected products (as reported)

VendorProductVersions
vim vim < 9.2.0276

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

References