This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-34714 →

ALPINE-CVE-2026-34714

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection...

Original description

The description as published by the source.

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Alpine:v3.23 vim

[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.1390"},{"fixed":"9.2.0272-r0"}]}]

References

advisory security.alpinelinux.org