This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-34982 →

ALPINE-CVE-2026-34982

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution whe...

Original description

The description as published by the source.

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The complete, guitabtooltip and printheader options are missing the P_MLE flag, allowing a modeline to be executed. Additionally, the mapset() function lacks a check_secure() call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Alpine:v3.23 vim

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0280-r0"}]}]

References

advisory security.alpinelinux.org