Homepage

OS Command Injection The advisory has been revoked - it doesn't affect any version of package vim-minimal  (opens in a new tab)

Threat Intelligence

EPSS
0.47% (38th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-VIMMINIMAL-15961673
  • published10 Apr 2026
  • disclosed6 Apr 2026
Report a new vulnerability Found a mistake?

Introduced: 6 Apr 2026

CVE-2026-34982  (opens in a new tab)
CWE-78  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by RHEL.

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The complete, guitabtooltip and printheader options are missing the P_MLE flag, allowing a modeline to be executed. Additionally, the mapset() function lacks a check_secure() call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.