Vim Has A 0-Day????

Claude AI discovered a remote code execution (RCE) vulnerability in Vim triggered by Vim's modeline feature, which allows files to embed and auto-execute editor commands on open. The exploit chains modeline commands to set up a tab panel expression that registers an autocommand, ultimately executing arbitrary shell commands when a malicious file is opened. A second vulnerability attributed to Emacs is also covered, but the author argues it's actually a Git fsmonitor config exploit — not an Emacs bug — that executes arbitrary scripts whenever git status is run inside a maliciously crafted repository. The author praises the Vim find as genuinely clever while criticizing the Emacs report as a misattributed bug that wastes maintainer time, drawing parallels to similar issues with cURL's HackerOne program.