cryingn/cve-2026-44656Reproduction environment for CVE-2026-44656, a Vim modeline command injection vulnerability. Includes Docker setup, PoC file, and exploit script to demonstrate arbitrary command execution via backtick expansion in the path option.
English|中文
This repository provides a reproduction environment for CVE-2026-44656. The vulnerability stems from a flaw in Vim's handling of backtick expansion expressions in the path option within modelines. Attackers can trigger arbitrary command execution using the Tab completion feature of the :find command.
path option)path to include a backtick expression. When the user triggers path completion with :find + Tab, the expression is evaluated, executing arbitrary commands.# 1. Build the Docker image
docker build -t cve_2026_44656_vim .
# 2. Run the container
docker run -it cve_2026_44656_vim
# 3. Open the PoC file inside the container
vim poc.txt
# 4. Trigger the vulnerability
# Type: :find
# Then press the Tab key to trigger path completion
# 5. Exit Vim
# Press ESC, then type :q and press Enter
# 6. Verify if the vulnerability was successfully exploited
ls sakana.pwn # ./eval.sh creates the file in the background
Dockerfile - Builds a Debian-based container containing the vulnerable version of Vimpoc.txt - PoC file containing the malicious modelineeval.sh - Attack payload script (creates sakana.pwn as verification)vimrc - Vim configuration file enabling modelinevim/ - Source code of the vulnerable Vim versionAdd set nomodeline to your vimrc to disable modeline processing, or avoid opening untrusted files with modeline enabled.