CVE-2026-34982

HighCVSS 8.2/10Last modified Oct 24, 2026

Description

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Apr 6, 2026
Last modified
Oct 24, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-349835.0Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is nCVE-2026-349846.5External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions CVE-2026-349856.5LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neurCVE-2026-349867.5Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web EnCVE-2026-349879.9Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compCVE-2026-349886.3Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator CVE-2026-349899.0CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme supportCVE-2026-34998.8The Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request FoCVE-2026-349907.8OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local uCVE-2026-349927.5Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to 2.4.5 and 2.5.2, a missing encryption vulnerability afCVE-2026-349937.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untCVE-2026-349995.3OpenViking versions 0.2.5 prior to 0.2.14 contain a missing authentication vulnerability in the bot proxy router that allows remote unauthen