Vim Has A 0-Day????

Good thing I haven’t been able to close vim since 2010. I’m still running vim 7.3 on the same terminal I opened my first hello world

jarvis, find me 0-day RCEs >Ok, here's 2 documented features

Everyone freaking out meanwhile people are still piping curl straight into bash

I checked my default vim configuration on Mac and not only is Modeline disabled, the config contains a comment referencing CVE-2007-2438 for the same issue. Truly a revolutionary find by Claude.

This is why i'm using punchcards

Finds bug where remote code can be executed by a built-in part of the system that executes code.

"We found a RCE in Emacs!" proceed to show a weird git feature

5:19 "They might be able to hack 25 people." Shots fired.

I might be showing my age here but we knew way back in the early 2000s that modelines were a bad idea, are unsafe and that every sane person has it disabled. But also no one wanted to fix this because some people are relying on this. Problem for Vim was that afaik until Vim8 modelines were still enabled by default and might still be? I only remember that Vim8 was the great breaking point to make saner default options. So it's not really a new bug or a zero day. We knew for literally decades. That's like saying "we found that using Xorg network server is unsafe and can be easily exploited" or "if you leave your front door open people can just walk in".

Bro found an alternative way to execute the exploit just so he doesn’t have to install emacs