Vim Modeline Vulnerability CVE-2026-34982
Fixed in latest version Linux, macOS, Windows Updated October 21, 2026
Quick answer
A crafted file could run shell commands via modelines in Vim 9.1.1178 to 9.2.0275. Update to 9.2.0276+ or add set nomodeline until your distro ships the fix.
Most likely fix: Update Vim.
Symptoms
Security scanners flag Vim; distro advisories list CVE-2026-34982 (CVSS 8.2) for your installed vim package.
Why it happens
- Options complete, guitabtooltip and printheader lacked the security flag that blocks them in modelines
- mapset() skipped a sandbox check
- Distro packages (e.g. Debian stable) lag behind upstream patches
How to fix it
Try these in order — the most common fix is first.
1. Update Vim
- Check your version with vim --version (look at 'Included patches')
- Update to Vim 9.2.0276 or later via your package manager or Homebrew
2. Disable modelines until patched
- Add set nomodeline to ~/.vimrc
- Avoid opening untrusted files in an unpatched Vim
This guide also covers
- cve-2026-34982
- vim modeline vulnerability
- vim security vulnerability 2026
Still not working?
If Vim keeps failing, you're not alone. See every Vim problem users report or the alternatives people switch to.
Other Vim errors
- How to Exit Vim (Stuck in Vim)
- Vim Copy to Clipboard Not Working
- Vim E325: ATTENTION Found a Swap File
- Vim E212: Can't Open File for Writing
- Vim E37: No Write Since Last Change
- Vim Backspace Not Working in Insert Mode
- Vim Paste Indentation Messed Up (Staircase Effect)
- Vim Colors Wrong in tmux
- Why Is Vim So Slow? (Large Files & Long Lines)
- Vim Arrow Keys Insert A B C D
- Vim Requires Python 3 Support Error (YouCompleteMe)