# GHSA-2gmj-rpqf-pxvh

## Summary

Vim modeline handling for the tabpanel option allows sandbox escape via autocmd_add, enabling OS command execution when opening a crafted file.

## Description

## Summary
A bug chain in Vim’s handling of the `tabpanel` option allows a crafted modeline to inject `%{expr}` expressions without `modelineexpr`, then escape the sandbox by calling `autocmd_add()` (which lacks a `check_secure()`), resulting in arbitrary OS command execution when a victim opens a file.

## Affected Package
- **Package:** Vim (https://github.com/vim/vim)
- **Ecosystem:** github
- **Affected versions:** `< 9.2.0272` *(advisory metadata lists `< 9.2.0172`, but the title and fix references point to 9.2.0272; see notes below)*
- **Patched version:** `9.2.0272`

## Details
The `tabpanel` option (`src/optiondefs.h:2581`) accepts `%{expr}` format strings similar to `statusline`/`tabline`. Those options carry the `P_MLE` flag so modeline usage requires `modelineexpr`; `tabpanel` does not, so modeline security checks (`src/option.c:1572-1576`) are skipped and arbitrary expression strings are accepted from modelines.

When Vim detects that the option was set insecurely, it evaluates the expression inside the sandbox (`src/eval.c:747-758`). However, `autocmd_add()` (`src/autocmd.c:3316`) lacks a `check_secure()` call. While the `:autocmd` ex-command is blocked in the sandbox, the function interface bypasses this restriction and allows sandboxed code to register autocommands that execute after the sandbox exits. This enables arbitrary command execution with the user’s privileges on opening a crafted file. `modeline` is enabled by default and `modelineexpr` does not need to be enabled. Builds with `+tabpanel` (FEAT_HUGE, default) are affected.

## Reproduction Steps
> **Note:** The advisory does not include an exact PoC; the following steps provide a concrete example based on the documented root cause. Adjust the `autocmd_add()` signature if your Vim version differs (`:help autocmd_add()`).

1. Install a vulnerable Vim build with `+tabpanel` (e.g., 9.2.0271):
   ```sh
   vim --version | grep +tabpanel
   ```
2. Create a file `poc.txt` with a malicious modeline that sets `tabpanel` to an expression that registers an autocommand:
   ```text
   hello
   vim: set tabpanel=%{autocmd_add('BufEnter','*','call system("id > /tmp/vim_pwn")')}: 
   ```
3. Open the file in Vim:
   ```sh
   vim poc.txt
   ```
4. Ensure the tab panel expression is evaluated (e.g., force a tabline and open a new tab):
   ```vim
   :set showtabline=2
   :tabnew
   ```
5. Trigger the autocommand (e.g., switch buffers or exit):
   ```vim
   :bnext
   :qall
   ```

**Expected (vulnerable behavior):** `/tmp/vim_pwn` is created and contains the output of `id`, demonstrating OS command execution outside the sandbox.

## Indicators of Success
- A file such as `/tmp/vim_pwn` is created by the `system()` call without explicitly enabling `modelineexpr` or running `:autocmd` manually.
- The command runs with the privileges of the user running Vim when the crafted file is opened.

## Notes
- Advisory metadata lists affected versions as `< 9.2.0172`, but the advisory title and references indicate the fix is in `v9.2.0272`. Treat `< 9.2.0272` as affected unless confirmed otherwise.
- No public PoC repositories were found via quick GitHub searches for `CVE-2026-34714` / `GHSA-2gmj-rpqf-pxvh`.

## References
- https://github.com/vim/vim/security/advisories/GHSA-2gmj-rpqf-pxvh
- https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d600815ec1f43459
- https://github.com/vim/vim/releases/tag/v9.2.0272


## Metadata

- Product: github:vim/vim
- Severity: high
- Status: open