macvim-dev / macvim-dev/macvim
Multiple CVEs — including CVE-2026-34714 (fixed upstream in Vim 9.2.0272)
Nobody has claimed this yet.
- Dominant language
- Vim Script
- Stars
- 7.9k
- Forks
- 691
- PR merge metrics
- No merged PRs in 30d
Description
Current public MacVim releases are listed as:
- r182: Vim 9.1.1887
- r182.1 prerelease: Vim 9.1.2068
These versions predate multiple upstream Vim security fixes from 2026, including:
- CVE-2026-28417, fixed in Vim 9.2.0073
- CVE-2026-33412, fixed in Vim 9.2.0202
- CVE-2026-34714, fixed in Vim 9.2.0272
Could you confirm whether these fixes were backported to MacVim, or whether an updated release is planned? CVE-2026-34714 looks especially relevant because it is triggered on opening a crafted file and mentions tabpanel.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the listed MacVim releases, r182 and r182.1 prerelease, with the upstream Vim versions that fixed CVE-2026-28417, CVE-2026-33412, and CVE-2026-34714. Verify whether those fixes are present and document whether a backport or updated release is planned; the issue does not name files or tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- macos, vim
- Domain
- desktop, release, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100