I use vim and have a use case for modelines. A modeline means that vim will parse a textfile for lines like:

# vim: set someoption=somevalue

and will then set those options. This is awesome if I'm the person writing the modelines, but it also might break down the assumption that I can open untrusted text files with my text editor with no harm.

Assume that I'm running an updated version of vim. Assume that I don't mind if someone can set annoying options that make things look bad (eg, messing with the tabwidth). What could a malicious text file do?


  • Ideally not a lot, but in practice it's not as ideal as the ideal would suggest. Just search for vim modeline vulnerability for a few examples of how this has gone wrong in the past. This is part of why modeline support is by default disabled if you're running vim as root.
    – tylerl
    May 16, 2013 at 4:16

3 Answers 3


Although in theory modelines shouldn't allow you to do anything bad, sanitizing modeline functions input is hard. There have been several security issues in the past that allowed arbitrary command execution or DoS attacks. To cite a few past vulnerabilities I could find:

While I believe they have all been fixed, new vulnerabilities keep popping up and it is likely that similar vulnerabilities will be found in the future, which is why distros disable modelines by default (at least Debian and SuSE do).

  • 1
    CVE-2019-12735 is another one as of 2016-06-11, Jun 11, 2019 at 23:42
  • @JoeMcMahon thanks, added!
    – Calimo
    Jun 12, 2019 at 6:27
  • It is fundamentally impossible to guarantee that all modeline-related security vulnerabilities have ever been "completely" :-) fixed so long as it is still possible to include embedded instructions to be executed by the code looking at the data in the very data itself. This is why the documentation for Keith Bostic's nvi has always said of modelines that the option is unimplemented and that it never will be. This is just like all the security bugs stemming from file-embedded commands or macro instructions to run in PDF, Word, Excel, &c&c&c.
    – tchrist
    Jun 17, 2019 at 19:13

Since the original question is tagged with "attack-prevention", I'm going to take that as a request, by the questioner, for available mitigation. I hope this is okay.

There is a plugin provided on the official vim website: securemodelines. It limits what can be done from a vim modeline depending on the contents of a whitelist. The plugin's karma score on the vim website is healthy, with an average rating (rating per download) comparable to that of The NERD Tree plugin.

The original creator, Dr. Ciaran McCreesh, has moved development to GitHub, from where various developers have forked it and customised it to their own needs, as can be seen in this GitHub network graph.

The original documentation is still on the official vim website, as linked to above.1


Vim modelines have in the past had arbitrary code execution bugs.
So they could do a lot of harm in the past.

First noticed in 6.3, fixed, some similar vulns found later.

Since the risk is inherent, (mixing data and code), modelines are generally disabled for root.

The way I understand it, previous bugs were fixed, so except for unpublished issues, using modern Vim it is safe to open un-trusted files with modelines on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.