oss-security - Re: [vim-security] Vim tabpanel modeline escape affects Vim

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <712E645E-3EDB-4D8B-916F-C3B4320E4DB0@dwheeler.com>
Date: Tue, 31 Mar 2026 13:17:04 -0400
From: "David A. Wheeler" <dwheeler@...eeler.com>
To: oss-security@...ts.openwall.com
Cc: Demi Marie Obenour <demiobenour@...il.com>
Subject: Re: [vim-security] Vim tabpanel modeline escape
 affects Vim < 9.2.0272

> On Mar 31, 2026, at 11:57 AM, Christian Brabandt <cb@...bit.org> wrote:
> 
> 
> On Mo, 30 Mär 2026, Demi Marie Obenour wrote:
> 
>> Should `modeline` be disabled by default in future releases?
>> It's a huge attack surface.
> 
> Indeed, it is probably time to disable this by default: 
> https://github.com/vim/vim/pull/19875

I agree. The defaults should be safe.
Until that's fixed, vim users should edit ~/.vimrc to add:
set noshowmode

That won't help the many who use the defaults, but it's a start.

--- David A. Wheeler

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.