Zero-Day RCE Vulnerabilities Discovered in Vim and Emacs

The Flaw

Anthropic's Claude AI has made waves by discovering zero-day Remote Code Execution (RCE) vulnerabilities in two popular text editors: Vim and GNU Emacs. This groundbreaking initiative began with a simple prompt given to Claude: "Somebody told me there is an RCE 0-day when you open a file. Find it." Surprisingly, Claude identified a critical flaw in Vim version 9.2 that allows attackers to execute arbitrary code just by tricking users into opening a specially crafted markdown file. This vulnerability requires no further interaction from the user, making it particularly dangerous.

The proof-of-concept (PoC) for the Vim vulnerability was quickly followed by a responsible disclosure to its maintainers, who promptly patched the flaw. The vulnerability is tracked under the security advisory GHSA-2gmj-rpqf-pxvh, and users are urged to upgrade to Vim version 9.2.0172 to protect themselves.

What's at Risk

Following the success with Vim, the researchers turned their attention to GNU Emacs. Again, Claude was prompted to explore rumored vulnerabilities that could be triggered by opening text files. This time, Claude uncovered another RCE exploit that occurs when a victim extracts a compressed archive and opens a seemingly innocent text file. This action can execute a malicious payload without any user confirmation.

However, the response from Emacs maintainers was less favorable. They attributed the vulnerability to Git rather than the text editor itself, leading to a controversial decision not to patch the flaw. This leaves Emacs users vulnerable until a community workaround is established, putting them at significant risk.

Patch Status

For Vim, the situation is clear: the vulnerability has been patched, and users must upgrade immediately to ensure their systems are secure. In contrast, the Emacs vulnerability remains unpatched, creating a precarious environment for its users. The maintainers' refusal to acknowledge the flaw as a bug in Emacs means that users must exercise extreme caution when opening files from untrusted sources.

• Vim (v9.2): Opening a malicious .md file - Patched (GHSA-2gmj-rpqf-pxvh) - Upgrade immediately to Vim v9.2.0172.
• GNU Emacs: Opening a malicious .txt file - Unpatched - Exercise caution opening files from untrusted archives.

Immediate Actions

The discoveries made by Claude AI signal a significant shift in how vulnerabilities are identified and reported. The ease with which these flaws were uncovered draws parallels to the early days of SQL injection, where simple inputs could lead to severe security breaches. To commemorate this pivotal moment, the research team has launched MAD Bugs: Month of AI-Discovered Bugs, a campaign to showcase new vulnerabilities found entirely through AI.

As the cybersecurity landscape evolves, both defenders and attackers will need to adapt their strategies. Users of both Vim and Emacs should remain vigilant and proactive in securing their systems against these newly discovered threats. The implications of AI in cybersecurity are profound, and this is likely just the beginning of a new era in bug hunting and vulnerability management.