CVE WatchJul 15, 2026

CVE-2026-34982

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command exe

CVSS

8.2

High

EPSS

0.5%

p38

KEV

—

Exploit Today

0-100

Published: Apr 6, 2026 · Last modified: Jul 15, 2026 · CWE-78

EPSS · 30d

0.5%EPSS · 30 days0.5%

2026-06-302026-07-17

Technical description

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-341978.8 HIG

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability4d CVE-2024-121210.0 CRI

99.9%

KEV—80Progress Kemp LoadMaster OS Command Injection Vulnerability5d CVE-2026-398089.8 CRI

99.7%

KEV—80Fortinet FortiSandbox OS Command Injection Vulnerability1d CVE-2022-262589.8 CRI

99.6%

KEV—80D-Link DIR-820L Remote Code Execution Vulnerability9d CVE-2026-422718.8 HIG

99.6%

KEV—80BerriAI LiteLLM Command Injection Vulnerability4d CVE-2021-252988.8 HIG

99.5%

KEV—80Nagios XI OS Command Injection9d