CVE-2026-34714: 
Vim vulnerability analysis and mitigation

CVE-2026-34714 is a code execution vulnerability in Vim caused by %{expr} injection via the tabpanel option lacking the P_MLE flag, allowing arbitrary OS command execution immediately upon opening a crafted file in the default configuration. It affects Vim versions greater than 9.1.1390 and less than 9.2.0272, with the vulnerability introduced in v9.1.1391. The flaw was disclosed on March 30, 2026, and patched in the same-day release of v9.2.0272. It carries a CVSS v3.1 base score of 8.6 (High) per NVD, and 9.2 (Critical) per ENISA (GitHub Advisory, Red Hat Bugzilla, Openwall OSS-Sec).

The root cause is a two-part bug chain classified under CWE-78 (OS Command Injection) and CWE-917 (Expression Language Injection). First, the tabpanel option in src/optiondefs.h:2581 accepts %{expr} format strings like statusline and tabline, but unlike those options, it is missing the P_MLE flag — meaning the modeline security check at src/option.c:1572-1576 is never triggered, allowing arbitrary expression strings to be injected via modelines without requiring modelineexpr to be enabled. Second, while Vim correctly evaluates the injected expression inside a sandbox (src/eval.c:747-758), the autocmd_add() function at src/autocmd.c:3316 lacks a check_secure() call; the :autocmd ex command is blocked in the sandbox, but the function interface bypasses this restriction, allowing sandboxed code to register an autocommand that fires after the sandbox exits and executes arbitrary OS commands. The fix adds the P_MLE flag to tabpanel and adds check_restricted()/check_secure() guards to autocmd_add() and autocmd_delete() (GitHub Commit, Openwall OSS-Sec).

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the user running Vim, immediately upon the victim opening a crafted file — no further interaction is required. This can lead to complete system compromise including unauthorized data access, data theft, file manipulation, and potential lateral movement within the victim's environment. Because modeline is enabled by default in Vim's FEAT_HUGE build (the standard distribution), and modelineexpr does not need to be enabled, the attack surface is broad and affects most default Vim installations (GitHub Advisory, Openwall OSS-Sec).

1. Craft a malicious file: Create a text file containing a Vim modeline that sets the tabpanel option with a %{expr} expression, e.g., a line such as /* vim: set tabpanel=%{autocmd_add([{'event':'VimEnter','cmd':'!malicious_command'}])}: */ embedded at the top or bottom of the file.
2. Deliver the file to the victim: Use social engineering, phishing, or supply chain methods to get the victim to download or receive the crafted file. The file can have any extension that the victim might open with Vim.
3. Victim opens the file: When the victim opens the file with a vulnerable Vim build (v9.1.1391–v9.2.0271, default FEAT_HUGE build), Vim processes the modeline and sets tabpanel to the injected %{expr} string without triggering the P_MLE security check.
4. Sandbox bypass via autocmd_add(): Vim evaluates the expression inside the sandbox, but the injected expression calls autocmd_add(), which lacks a check_secure() guard, registering an autocommand (e.g., on VimEnter or BufRead) that executes after the sandbox exits.
5. Arbitrary command execution: The registered autocommand fires, executing the attacker-specified OS command with the privileges of the user running Vim, achieving full code execution (Openwall OSS-Sec, GitHub Advisory).

• File System: Presence of files with embedded Vim modelines containing tabpanel=%{...} or tpl=%{...} expressions; unexpected scripts or executables created in user home or temp directories shortly after opening a file in Vim.
• Process: Unusual child processes spawned by the Vim process (e.g., /bin/sh, bash, curl, wget, python, nc) immediately after file open events; processes running under the user's account with no clear interactive origin.
• Logs: Shell history or audit logs showing unexpected command execution correlated with Vim process start times; auditd records of execve syscalls from Vim's process tree.
• Network: Unexpected outbound network connections (reverse shells, data exfiltration) originating from the user's session shortly after opening a file in Vim.

Upgrade Vim to version 9.2.0272 or later, which adds the P_MLE flag to the tabpanel option and adds check_secure() guards to autocmd_add()/autocmd_delete() (GitHub Commit, Vim Release). As a temporary workaround, add set nomodeline to your ~/.vimrc to disable modeline processing entirely, which prevents the injection vector from being triggered. Additionally, restrict opening files from untrusted sources with Vim until patching is complete. Linux distribution users should apply vendor-provided updates (e.g., Red Hat, Amazon Linux, openSUSE, Fedora packages) as they become available (Red Hat Bugzilla, Feedly).

The vulnerability was notably highlighted in coverage by CSO Online, InfoWorld, and Network World in the context of AI-assisted vulnerability discovery, as Claude Code was reported to have identified this and a related GNU Emacs zero-day (CSO Online). The Hacker News weekly recap also included the vulnerability in its roundup of notable security events. The oss-security mailing list disclosure by Vim maintainer Christian Brabandt was detailed and well-received, with follow-up discussion threads on oss-sec. The Greenbone April 2026 threat report flagged the vulnerability as noteworthy for enterprise patch prioritization.