What's the vulnerability?

Vim modeline handling for the tabpanel option allows sandbox escape via autocmd_add, enabling OS command execution when opening a crafted file.

Root Cause Analysis

Variant Analysis

Bypass and alternate trigger exploration (if present).
One Command

Verify with pruva-verify

Run the Pruva CLI to automatically fetch and execute the reproduction script.

pruva-verify REPRO-2026-00124
or pruva-verify GHSA-2GMJ-RPQF-PXVH
or pruva-verify CVE-2026-34714
Install: curl -fsSL https://pruva.dev/install.sh | sh

Or Run Manually

1

Download the script

curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00124/artifacts/repro/reproduction_steps.sh
2

Make executable

chmod +x reproduction_steps.sh
3

Run the script

./reproduction_steps.sh
Run in a VM, container, or disposable environment. This exploits a real vulnerability.

How Pruva Reproduced This

Watch the AI agent's step-by-step process.

Loading session...

Artifacts

repro/rca_report.md4.8 KB
repro/reproduction_steps.sh3.9 KB
vuln_variant/rca_report.md5.8 KB
vuln_variant/reproduction_steps.sh7.2 KB
bundle/AGENTS.repro.md0.5 KB
bundle/ticket.json4.1 KB
bundle/ticket.md3.6 KB
repro/bang_test.txt0.1 KB
repro/bang_test2.txt0.1 KB
repro/base64_test.txt0.1 KB
repro/base64_test2.txt0.1 KB
repro/debug_poc.txt0.2 KB
repro/dict_test.txt0.0 KB
repro/dict_test2.txt0.1 KB
repro/escape_brace.txt0.1 KB
repro/escape_colon.txt0.1 KB
repro/escape_test.txt0.1 KB
repro/execute_test.txt0.1 KB
repro/execute_test2.txt0.1 KB
repro/expr_poc.txt0.1 KB
repro/expr_test.txt0.1 KB
repro/final_poc.txt0.1 KB
repro/fn_test.txt0.1 KB
repro/fn_test2.txt0.1 KB
repro/len_test.txt0.0 KB
repro/length_test.txt0.1 KB
repro/length_test2.txt0.1 KB
repro/length_test3.txt0.1 KB
repro/list_test.txt0.1 KB
repro/minimal_expr.txt0.0 KB
repro/poc.txt0.1 KB
repro/poc2.txt0.0 KB
repro/poc3.txt0.2 KB
repro/poc4.txt0.2 KB
repro/poc5.txt0.2 KB
repro/quote_test.txt0.1 KB
repro/redraw_poc.txt0.1 KB
repro/reeval_test.txt0.1 KB
repro/reeval_test2.txt0.1 KB
repro/result_poc.txt0.1 KB
repro/runtime_manifest.json0.6 KB
repro/short2_poc.txt0.1 KB
repro/short_poc.txt0.1 KB
repro/simple_expr.txt0.1 KB
repro/simple_poc.txt0.0 KB
repro/simplest_poc.txt0.0 KB
repro/single_quote.txt0.1 KB
repro/statusline_test.txt0.1 KB
repro/string_dict.txt0.1 KB
repro/test.vim0.2 KB
repro/test_flags.vim0.1 KB
repro/validation_verdict.json0.7 KB
repro/vim9_dict.txt0.1 KB
repro/working_poc.txt0.1 KB
logs/full_exploit.txt0.1 KB
logs/modeline_test.txt0.0 KB
logs/t1.txt0.0 KB
logs/vuln_variant/final_verification.log3.2 KB
logs/vuln_variant/ph_test.txt0.0 KB
logs/vuln_variant/printheader_fixed_test.txt0.0 KB
logs/vuln_variant/tabpanel_fixed.txt0.0 KB
logs/vuln_variant/tabpanel_fixed_test.txt0.0 KB
logs/vuln_variant/test1_modeline.txt0.0 KB
logs/vuln_variant/test1_output.txt0.0 KB
logs/vuln_variant/test3_output.txt0.0 KB
logs/vuln_variant/test3_printheader.txt0.1 KB
logs/vuln_variant/test4_modeline.txt0.1 KB
logs/vuln_variant/test4_output.txt0.0 KB
logs/vuln_variant/test6_output.txt0.0 KB
logs/vuln_variant/test7_output.txt0.0 KB
logs/vuln_variant/test7_titlestring.txt0.1 KB
logs/vuln_variant/ts_test.txt0.0 KB
logs/vuln_variant/variant_run.log3.2 KB
logs/vuln_variant/variant_run_final.log3.2 KB
logs/vuln_variant/variant_test1.txt0.1 KB
logs/vuln_variant/variant_test2.txt0.1 KB
logs/vuln_variant/variant_test3.txt0.1 KB
vuln_variant/patch_analysis.md4.7 KB
vuln_variant/source_identity.json0.7 KB
vuln_variant/validation_verdict.json2.3 KB
vuln_variant/variant_manifest.json2.3 KB