Vim modeline flaw lets attackers run OS commands when a crafted file is opened

A newly disclosed Vim vulnerability can let attackers execute arbitrary operating system commands when a user opens a specially crafted file. The flaw, tracked as CVE-2026-34982, affects Vim versions earlier than 9.2.0276 and was fixed on March 31, 2026.

The issue sits in Vim’s modeline handling. Vim uses modelines to let files set editor options automatically, but the project’s GitHub security advisory says several options were missing the P_MLE safeguard and mapset() also lacked a check_secure() call. Together, those gaps created a modeline sandbox bypass.

BEST SPRING 2026 DEALS

Editor's Choice

Private Internet Access

Access content across the globe at the highest speed rate.

70% of our readers choose Private Internet Access

70% of our readers choose ExpressVPN

ExpressVPN

Browse the web from multiple devices with industry-standard security protocols.

Nord VPN

Faster dedicated servers for specific actions (currently at summer discounts)

In plain terms, that means a victim does not need to run a separate payload manually. Opening a malicious text file in a vulnerable Vim build can trigger arbitrary command execution with the same privileges as the current user.

What caused the bug

According to the advisory, the vulnerable options were complete, guitabtooltip, and printheader. The complete option was especially risky because it accepts F{func} syntax for completion callbacks, but unlike completefunc, it had neither P_SECURE nor P_MLE. That allowed arbitrary lambda expressions to be accepted from modelines.

The advisory also says attackers could abuse mapset() from sandboxed expressions because the function lacked check_secure(). Similar effects could be achieved by setting guitabtooltip and printheader through a modeline and then using mapset() to execute arbitrary code on random key mappings.

Vim rates the issue as High severity. The published CVSS 3.1 score is 8.2, with a local attack vector, low attack complexity, no privileges required, required user interaction, changed scope, and high confidentiality and integrity impact.

Why this matters for developers and Linux users

This flaw matters because Vim sits deep inside Linux distributions, servers, and developer workflows. A malicious repository file, text document, or source file could become an attack trigger if a user opens it in an unpatched Vim installation. That makes developers and administrators especially relevant targets. This is an inference from how Vim is commonly used, while the command-execution impact itself comes directly from the advisory.

The good news is that the fix is already available. Vim says the issue is fixed as of patch v9.2.0276, and the advisory lists 9.2.0276 as the patched version.

For systems that cannot be updated immediately, disabling modelines reduces exposure. Adding set nomodeline to a local .vimrc prevents modelines from being processed, which cuts off the attack path described in the advisory. That workaround follows from the fact that the bug depends on modeline execution.

What users should do now

• Update Vim to version 9.2.0276 or later.
• Disable modelines with set nomodeline until patching is complete.
• Treat untrusted text files, source files, and cloned repositories carefully on systems that still run older Vim builds. This follows from the advisory’s crafted-file attack scenario.
• Review shared development environments and containers that may carry older packaged Vim versions. This is a practical response based on the affected-version range published by Vim.

Vulnerability details at a glance

FAQ