【新人报道】vim 1-click RCE 的简单分析

问题描述：

关键连接：

github.com/califio/publications

MADBugs/vim-vs-emacs-vs-claude/vim.md

main

# Vim tabpanel modeline RCE affects Vim < 9.2.0272 ## Summary A two-bug chain in Vim allows arbitrary command execution when a user opens a crafted file. The `tabpanel` option can be set from a modeline without requiring `modelineexpr`, and its expression is later evaluated in the sandbox. That sandbox can be escaped because `autocmd_add()` does not check whether it is running in a secure context, allowing deferred execution outside the sandbox. --- ## Technical Details The issue depends on two flaws: 1. **`tabpanel` is missing `P_MLE`** Unlike `statusline` and `tabline`, `tabpanel` is not marked with the `P_MLE` flag. This allows a modeline to inject `%{...}` expressions even when `modelineexpr` is disabled. 2. **`autocmd_add()` lacks `check_secure(