[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <A958E069-337B-452C-972B-2833B01835C1@dwheeler.com>
Date: Thu, 2 Apr 2026 13:12:58 -0400
From: "David A. Wheeler" <dwheeler@...eeler.com>
To: oss-security@...ts.openwall.com
Cc: Demi Marie Obenour <demiobenour@...il.com>
Subject: Re: [vim-security] Vim tabpanel modeline escape
affects Vim < 9.2.0272
> On Apr 1, 2026, at 3:45 AM, Christian Brabandt <cb@...bit.org> wrote:
>
>
> On Di, 31 Mär 2026, David A. Wheeler wrote:
>
>> Until that's fixed, vim users should edit ~/.vimrc to add:
>> set noshowmode
>
> I guess you mean :set nomodeline
Yes, nomodeline, sorry for the error. You *can* say ":set" but it's
conventional to omit the colon prefix.
I did find this gem in vim ":help modeline":
> Still, there is always a small risk that a modeline causes trouble. E.g.,
> when some joker sets 'textwidth' to 5 all your lines are wrapped unexpectedly.
> So disable modelines before editing untrusted text.
If vim just has a weird display, instead of executing programs, I guess
it's arguable that this isn't "insecure by default". But this at least teeters close to it.
When people use a text editor, they're not trying to think
through trust boundary issues & exactly where the file originally came from.
Presuming people will add special options to use vim on a file is asking too much.
At the very least, its implementation has been shown to be brittle,
and it's documented that you shouldn't be using this on files you can't
totally trust.
I think it's best to disable this functionality for now.
Perhaps it should be disabled by default until it has a better
self-protection mechanism. The default should only allow specific fields
with specific permitted value ranges, so that attackers can't mess with people.
A 'textwidth' of 5, set without user approval, sounds like a bad idea.
Tabs are pretty much only a few valid values; I doubt "250" is a reasonable one.
If someone really wants the existing modeline behavior, an "insecure modeline" option
would make sense, but I bet most users would not enable it.
--- David A. Wheeler
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
