On Mo, 30 Mär 2026, Demi Marie Obenour wrote:
> On 3/30/26 05:06, Christian Brabandt wrote: > > ## Impact > > An attacker who can deliver a crafted file to a victim achieves > > arbitrary command execution with the privileges of the user running Vim. > > The attack requires only that the victim opens the file; no further > > interaction is needed. `modeline` is enabled by default and > > `modelineexpr` does not need to be enabled. Vim builds with `+tabpanel` > > (FEAT_HUGE, the default) are affected. > > Should `modeline` be disabled by default in future releases? > It's a huge attack surface. Indeed, it is probably time to disable this by default: https://github.com/vim/vim/pull/19875 Thanks, Christian -- Zwei Schneeflocken begegnen sich auf ihrem Weg zur Erde. Die eine: "Wohin?" "Nach Bayern - Wintersport. Und du?" "Nach Norddeutschland - Verkehrschaos."
