Vim tabpanel modeline escape affects Vim > 9.1.1390 && Vim < 9.2.0272
Date: 30.03.2026
Severity: High
CVE: CVE-2026-34714
CWE: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Summary
A bug chain in Vim allows arbitrary OS command execution when a user opens
a crafted file. The tabpanel option is missing the P_MLE flag, allowing a
modeline to inject a %{expr} expression string without requiring
modelineexpr to be enabled. Although Vim correctly evaluates the expression
inside the sandbox, autocmd_add() lacks a check_secure() call, allowing
sandboxed code to register an autocommand that fires after the sandbox exits.
This vulnerability has been introduced with Vim v9.1.1391. Earlier versions are not affected.
Description
The tabpanel option (src/optiondefs.h:2581) accepts %{expr} format
strings identically to statusline and tabline, both of which carry the
P_MLE flag to require modelineexpr for modeline use. tabpanel is missing
this flag, so the modeline security check at src/option.c:1572-1576 is never
reached and arbitrary expression strings are accepted from modelines.
Vim correctly detects that the option was set insecurely and evaluates the
expression inside the sandbox (src/eval.c:747-758). However,
autocmd_add() (src/autocmd.c:3316) contains no check_secure() call.
While the :autocmd ex command is properly blocked in the sandbox (no EX_SBOXOK),
but the function interface bypasses this restriction.
Impact
An attacker who can deliver a crafted file to a victim achieves arbitrary
command execution with the privileges of the user running Vim. The attack
requires only that the victim opens the file; no further interaction is needed.
modeline is enabled by default and modelineexpr does not need to be
enabled. Vim builds with +tabpanel (FEAT_HUGE, the default) are affected.
Acknowledgements
The Vim project would like to thank Hung Nguyen for identifying the vulnerability
chain, providing a detailed root cause analysis, reproduction steps, and
suggested fixes.
References
The issue has been fixed as of Vim patch v9.2.0272
Vim tabpanel modeline escape affects Vim > 9.1.1390 && Vim < 9.2.0272
Date: 30.03.2026
Severity: High
CVE: CVE-2026-34714
CWE: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Summary
A bug chain in Vim allows arbitrary OS command execution when a user opens
a crafted file. The
tabpaneloption is missing theP_MLEflag, allowing amodeline to inject a
%{expr}expression string without requiringmodelineexprto be enabled. Although Vim correctly evaluates the expressioninside the sandbox,
autocmd_add()lacks acheck_secure()call, allowingsandboxed code to register an autocommand that fires after the sandbox exits.
This vulnerability has been introduced with Vim v9.1.1391. Earlier versions are not affected.
Description
The
tabpaneloption (src/optiondefs.h:2581) accepts%{expr}formatstrings identically to
statuslineandtabline, both of which carry theP_MLEflag to requiremodelineexprfor modeline use.tabpanelis missingthis flag, so the modeline security check at
src/option.c:1572-1576is neverreached and arbitrary expression strings are accepted from modelines.
Vim correctly detects that the option was set insecurely and evaluates the
expression inside the sandbox (
src/eval.c:747-758). However,autocmd_add()(src/autocmd.c:3316) contains nocheck_secure()call.While the
:autocmdex command is properly blocked in the sandbox (noEX_SBOXOK),but the function interface bypasses this restriction.
Impact
An attacker who can deliver a crafted file to a victim achieves arbitrary
command execution with the privileges of the user running Vim. The attack
requires only that the victim opens the file; no further interaction is needed.
modelineis enabled by default andmodelineexprdoes not need to beenabled. Vim builds with
+tabpanel(FEAT_HUGE, the default) are affected.Acknowledgements
The Vim project would like to thank Hung Nguyen for identifying the vulnerability
chain, providing a detailed root cause analysis, reproduction steps, and
suggested fixes.
References
The issue has been fixed as of Vim patch v9.2.0272