CVE-2026-34982 — OS Command Injection in VIM

CWE-78 — OS Command Injection36 documents9 sources
Severity
8.2HIGHNVD
EPSS
0.0%
top 94.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
VIMDebian VIMMsrc Azl3 VIM 9.2.0240-1 ON Azure Linux 3.0+1 more
Timeline
PublishedApr 6
Latest updateApr 13

Description

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NExploitability: 1.8 | Impact: 5.8

Affected Packages4 packages

▶CVEListV5vim/vim< 9.2.0276
▶debiandebian/vim< vim 2:9.2.0315-1 (sid)

🔴Vulnerability Details

1
OSV
CVE-2026-34982: Vim is an open source, command line text editor↗2026-04-06
▶

📋Vendor Advisories

4
Ubuntu
Vim vulnerabilities↗2026-04-13
▶
Red Hat
vim: arbitrary command execution via modeline sandbox bypass↗2026-04-06
▶
Microsoft
Vim modeline bypass via various options affects Vim < 9.2.0276↗2026-04-02
▶
Debian
CVE-2026-34982: vim - Vim is an open source, command line text editor. Prior to version 9.2.0276, a mo...↗2026
▶

🕵️Threat Intelligence

28
Hackernews
⚡ Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits, Paragon Spyware and More↗2026-04-06
▶
Wiz
CVE-2026-34714 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-34379 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-28422 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-34378 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶

💬Community

2
Bugzilla
CVE-2026-34982 vim: arbitrary command execution via modeline sandbox bypass↗2026-04-06
▶
Bugzilla
CVE-2026-34982 vim: arbitrary command execution via modeline sandbox bypass [fedora-all]↗2026-04-06
▶
CVE-2026-34982 — OS Command Injection in VIM | cvebase