AI discovers RCE vulnerabilities in Vim and Emacs text editors

Vulnerabilities in the widely used Vim and GNU Emacs text editors, discovered with the assistance of the Claude AI, allow for remote code execution simply by opening a specially crafted file. These flaws were found when the AI was prompted to identify security weaknesses in the editors. The assistant not only found the vulnerabilities but also helped create proof-of-concept exploits and suggested fixes, as reported by Bleeping Computer.

A researcher used Claude to find a vulnerability in Vim by analyzing its source code. The flaw, related to modeline handling, allows code embedded in a file to execute upon opening, even bypassing sandbox restrictions. This vulnerability affects Vim versions 9.2.0271 and earlier and has been patched in version 9.2.0272.

For GNU Emacs, the vulnerability lies within its Git integration. Opening a file triggers Git operations that can execute arbitrary commands via a user-defined core.fsmonitor program. Emacs maintainers consider this a Git issue, leaving the issue unpatched in Emacs.

Source: Bleeping Computer