[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ac6tgGE2oH6dKiAQ@256bit.org>
Date: Thu, 2 Apr 2026 19:55:12 +0200
From: Christian Brabandt <cb@...bit.org>
To: oss-security@...ts.openwall.com
Cc: Demi Marie Obenour <demiobenour@...il.com>
Subject: Re: [vim-security] Vim tabpanel modeline escape
affects Vim < 9.2.0272
On Do, 02 Apr 2026, David A. Wheeler wrote:
> I think it's best to disable this functionality for now.
> Perhaps it should be disabled by default until it has a better
> self-protection mechanism. The default should only allow specific fields
> with specific permitted value ranges, so that attackers can't mess with people.
> A 'textwidth' of 5, set without user approval, sounds like a bad idea.
> Tabs are pretty much only a few valid values; I doubt "250" is a reasonable one.
>
> If someone really wants the existing modeline behavior, an "insecure modeline" option
> would make sense, but I bet most users would not enable it.
It seems the community prefers a whitelist approach however. So this is
probably what it will be soon.
Thanks,
Christian
--
F: Was ist golden und fliegt durch die Luft?
A: Maikäfer mit Goldzahn.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
