CVE-2026-34714

Published: Mar 30, 2026 Last Modified: Mar 30, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,2
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: low

Description

AI Translation Available

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability Non-Repudiation
Potential Impacts:
Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Read Files Or Directories Modify Files Or Directories Read Application Data Modify Application Data Hide Activities
Applicable Platforms
Technologies: AI/ML, Not Technology-Specific, Web Server
Likelihood of Exploit: High
View CWE Details
https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d…
https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d600815ec1f43459
https://github.com/vim/vim/releases/tag/v9.2.0272
https://github.com/vim/vim/releases/tag/v9.2.0272
https://github.com/vim/vim/security/advisories/GHSA-2gmj-rp…
https://github.com/vim/vim/security/advisories/GHSA-2gmj-rpqf-pxvh
https://www.openwall.com/lists/oss-security/2026/03/30/3
https://www.openwall.com/lists/oss-security/2026/03/30/3