Vim and Emacs RCE Vulnerabilities Found by Claude AI

The Flaw

Recent discoveries by Claude AI have unveiled serious vulnerabilities in both Vim and GNU Emacs text editors. These flaws allow remote code execution (RCE) simply by opening a specially crafted file. The vulnerabilities were identified by Hung Nguyen, a researcher at Calif, who instructed Claude to analyze the source code of Vim. The assistant found missing security checks related to modeline handling, which is a feature that instructs Vim on how to process files. This oversight means that malicious code embedded in a file can execute automatically when the file is opened.

In the case of Vim, this vulnerability affects all versions up to 9.2.0271. Users who open a crafted file can unknowingly execute commands with the same privileges as the user running Vim. The Vim team has responded promptly, releasing a patch in version 9.2.0272 to mitigate this risk. However, the situation is more complex for GNU Emacs.

What's at Risk

GNU Emacs faces a different issue stemming from its integration with Git. The vulnerability arises when opening a file triggers Git operations that can lead to arbitrary command execution. This is due to the vc-git functionality, which reads the .git/config file and can run user-defined scripts. An attacker could exploit this by creating an archive containing a hidden .git/ directory with a malicious config file. When a victim opens the text file, the payload executes without any visible warnings.

The GNU Emacs maintainers argue that the responsibility lies with Git, as nothing is executed directly within Emacs. However, this does not diminish the risk to users, as Emacs automatically runs Git commands on untrusted directories. The lack of sandbox protections or user consent exacerbates the potential for exploitation.

Patch Status

While Vim has released a patch to address its vulnerability, GNU Emacs has not yet implemented a fix. The maintainers suggest that it is Git's responsibility to address the issue, leaving users vulnerable in the meantime. Nguyen has recommended that Emacs modify its Git calls to block potentially dangerous scripts from executing automatically. Until a patch is released, users are strongly advised to exercise caution when opening files from unknown sources.

Immediate Actions

For users of Vim, it is crucial to update to version 9.2.0272 or later to protect against the identified RCE vulnerability. For GNU Emacs users, the best course of action is to avoid opening files from untrusted sources, especially those that may contain hidden Git directories. It's essential to remain vigilant and monitor for updates from Emacs maintainers regarding a potential fix. By taking these precautions, users can significantly reduce their risk of falling victim to these vulnerabilities.