We asked Claude to find a bug in Vim. It found an RCE. Just open a file, and you’re owned. We joked: fine, we’ll switch to Emacs. Then Claude found an RCE there too.
Giờ làm hacker kiểu ngồi prompt với AI thôi là đủ à thật đáng sợ. Nhưng thật ra hiểu sâu đến mức có thể prompt được AI để hack cũng vẫn phải học bài bản đã. Sợ là bài viết này cổ vũ các bạn học tập hack chỉ bằng ngồi đốt token cho AI nhiều hơn.
My background is that i am a computational Material scientist, NOT A COMPUTER Scientist (but enthusiast).
I can tell you that a lot of scientists working on HPC ssh into remote clusters and use vim or emacs editors from the terminal to write and queue code for execution. I'm guessing opening vim after ssh-ing into a remote server will not be compromised by this bug, or am i wrong?
My guess is that this only affects people using vim on their home computer. Most people use VScode with vim plugin. I guess they didn't find anything else they would have reported it. I guess the question is:
For the bugs described in the post, it will not compromise the local machine directly as we use ssh to connect to a remote server. But it could compromise the user on remote server that use vim (on remote server) to read/edit the malicious file. The direct impact can change in case someone wants to use local vim with SSHFS (to mount folders on remote server to local one).
For the vim plugin for VS Code (vscodevim/vim I think?), it's a Vim emulation extension and not actual vim software. It didn't implement the vulnerable function. Therefore, this bug is not applied to this vim for VS Code plugin.
All this proves is that almost ANY software over a few thousand lines of code has a critical vulnerability in it.
That should have been obvious to anyone in cybersecurity.
Giờ làm hacker kiểu ngồi prompt với AI thôi là đủ à thật đáng sợ. Nhưng thật ra hiểu sâu đến mức có thể prompt được AI để hack cũng vẫn phải học bài bản đã. Sợ là bài viết này cổ vũ các bạn học tập hack chỉ bằng ngồi đốt token cho AI nhiều hơn.
My background is that i am a computational Material scientist, NOT A COMPUTER Scientist (but enthusiast).
I can tell you that a lot of scientists working on HPC ssh into remote clusters and use vim or emacs editors from the terminal to write and queue code for execution. I'm guessing opening vim after ssh-ing into a remote server will not be compromised by this bug, or am i wrong?
My guess is that this only affects people using vim on their home computer. Most people use VScode with vim plugin. I guess they didn't find anything else they would have reported it. I guess the question is:
Does this bug extend to vim plugins in VSCode??
For the bugs described in the post, it will not compromise the local machine directly as we use ssh to connect to a remote server. But it could compromise the user on remote server that use vim (on remote server) to read/edit the malicious file. The direct impact can change in case someone wants to use local vim with SSHFS (to mount folders on remote server to local one).
For the vim plugin for VS Code (vscodevim/vim I think?), it's a Vim emulation extension and not actual vim software. It didn't implement the vulnerable function. Therefore, this bug is not applied to this vim for VS Code plugin.
thanks. Appreciate the input.
There's been quite a few vim modeline vulnerabilities in the past:
https://security.stackexchange.com/questions/36001/vim-modeline-vulnerabilities
If you're a vim user, it's better to just add "set nomodeline" to your .vimrc
Very interesting. Could you also share a Claude Code transcript next time, for example, using this tool: https://github.com/simonw/claude-code-transcripts
if the second bug is related to Git, why not report it to Git first? what would stop someone from exploiting it outside of Emacs?
Excellent work. Thank you for sharing.
I believe the patch version is wrong FYI, its 272 not 172
Did you ask Claude where it found the exploit i.e. articles etc?