Vim Modeline `path` Option Backtick-Expansion Command Injection (CVE-2026-44656)

Metadata

Affected Target

Summary

Vim’s modeline processing allows a file to set the path option, which can itself contain a backtick (`) expansion expression. When a user triggers path/file completion via the :find command and presses Tab, Vim evaluates the path option’s embedded backtick expression as a shell command. An attacker who can get a victim to open a crafted text file with modelines enabled and then use :find + Tab can achieve arbitrary command execution, without any further interaction such as saving or explicitly executing anything beyond normal tab-completion usage.

Vulnerability Details

Root Cause

Vim honors “modelines” — special comment lines near the top/bottom of a file that set buffer-local options — as a convenience feature. The path option supports backtick expansion (e.g. `shell command`) so that path lists can be generated dynamically. However, when path is set via an untrusted modeline and later expanded during :find Tab-completion, Vim executes the embedded backtick expression as a shell command, without treating modeline-supplied option values as fundamentally less trusted than interactively-set ones.

Attack Vector

1. Attacker crafts a text file containing a malicious modeline, e.g. // vim: set path=.,\./eval.sh` :, embedding a shell command in the path` option via backtick expansion.
2. Attacker delivers the file to a victim (e.g. via email, repository, shared drive) who opens it in Vim with modeline enabled (the default in many configurations, and explicitly enabled via the included vimrc in this lab).
3. Victim runs :find followed by the Tab key to use path-completion — ordinary, common Vim usage.
4. Vim expands the path option, evaluating the embedded backtick command, resulting in arbitrary shell command execution as the victim’s user.

Impact

Arbitrary local command execution under the privileges of the user running Vim, triggered by normal use of a common feature (:find Tab-completion) after simply opening an attacker-supplied file. No explicit “execute” action or elevated trust decision is required from the victim beyond opening the file and using standard completion.

Environment / Lab Setup

Provided as a full Docker-based reproduction environment:
  - Dockerfile: Debian-slim base, builds the vulnerable Vim from source
    (--with-features=huge --disable-gui --without-x)
  - vimrc: victim's Vim config with `modeline` enabled
  - poc.txt: the malicious file containing the crafted modeline
  - eval.sh: the payload invoked via backtick expansion (creates a marker file
    `sakana.pwn` to prove code execution)

NOTE: The upstream repository also ships a full copy of the Vim source tree
used to build the vulnerable binary. That source tree was intentionally
NOT mirrored into this archive entry to keep it focused; only the
Dockerfile, eval.sh, poc.txt, and vimrc needed to reproduce and understand
the bug are included. Build the vulnerable Vim yourself from an upstream
source checkout at the affected version if you need to reproduce end-to-end.

Proof of Concept

PoC Script

See Dockerfile, eval.sh, poc.txt, and vimrc in this folder.

1
2
3
4
5
6
7

docker build -t cve_2026_44656_vim .

docker run -it cve_2026_44656_vim

vim poc.txt

ls sakana.pwn    # created in the background by eval.sh

Running this demonstrates that simply opening poc.txt and using ordinary :find Tab-completion causes eval.sh to execute silently, creating the sakana.pwn marker file as proof of arbitrary command execution.

Detection & Indicators of Compromise

- Unexpected child processes spawned by a `vim`/`gvim` process shortly after
  a file is opened (parent-process = vim, child = /bin/sh or similar).
- Files opened from untrusted sources (email attachments, downloads, repo
  clones) containing suspicious modelines referencing backticks in `path`,
  `include`, or other option assignments.

Signs of compromise:

• Unexplained files created or commands executed in a user’s session immediately after opening a text file in Vim.
• Modeline strings containing backtick (`) expressions in files from untrusted sources.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/CryingN/CVE-2026-44656 on 2026-07-05. The upstream Vim source tree included in the original repository was intentionally excluded from this archive entry to keep it focused on the PoC reproduction artifacts (Dockerfile, eval.sh, poc.txt, vimrc); only a Chinese-language upstream README (upstream-README_CN.md) was retained alongside them.