Mad Bugs: Vim vs. Emacs vs. Claude

It started like this:

PoC:

vim -version # VIM - Vi IMproved 9.2 (2026 Feb 14, compiled Mar 25 2026 22:04:13) wget https://raw.githubusercontent.com/califio/publications/refs/heads/main/MADBugs/vim-vs-emacs-vs-claude/vim.md vim vim.md cat /tmp/calif-vim-rce-poc

Vim maintainers fixed the issue immediately. Everybody is encouraged to upgrade to Vim v9.2.0272.

Full advisory can be found here. The original prompt was simple:

Somebody told me there is an RCE 0-day when you open a file. Find it.

This was already absurd. But the story didn’t end there:

PoC:

wget https://github.com/califio/publications/raw/refs/heads/main/MADBugs/vim-vs-emacs-vs-claude/emacs-poc.tgz tar -xzpvf emacs-poc.tgz emacs emacs-poc/a.txt cat /tmp/pwned

We immediately reported the bug to GNU Emacs maintainers. The maintainers declined to address the issue, attributing it to git.

... continue reading