Re: [vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272

["David A. Wheeler" <dwheeler () dwheeler com>]

> On Apr 1, 2026, at 3:45 AM, Christian Brabandt <cb () 256bit org> wrote:
>
>
> On Di, 31 Mär 2026, David A. Wheeler wrote:
>
> > Until that's fixed, vim users should edit ~/.vimrc to add:
> > set noshowmode
>
> I guess you mean :set nomodeline

Yes, nomodeline, sorry for the error. You *can* say ":set" but it's
conventional to omit the colon prefix.

I did find this gem in vim ":help modeline":

> Still, there is always a small risk that a modeline causes trouble.  E.g.,
> when some joker sets 'textwidth' to 5 all your lines are wrapped unexpectedly.
> So disable modelines before editing untrusted text.

If vim just has a weird display, instead of executing programs, I guess
it's arguable that this isn't "insecure by default". But this at least teeters close to it.
When people use a text editor, they're not trying to think
through trust boundary issues & exactly where the file originally came from.
Presuming people will add special options to use vim on a file is asking too much.

At the very least, its implementation has been shown to be brittle,
and it's documented that you shouldn't be using this on files you can't
totally trust.

I think it's best to disable this functionality for now.
Perhaps it should be disabled by default until it has a better
self-protection mechanism. The default should only allow specific fields
with specific permitted value ranges, so that attackers can't mess with people.
A 'textwidth' of 5, set without user approval, sounds like a bad idea.
Tabs are pretty much only a few valid values; I doubt "250" is a reasonable one.

If someone really wants the existing modeline behavior, an "insecure modeline" option
would make sense, but I bet most users would not enable it.

--- David A. Wheeler