[NetSIG] vim zero-day (fixed) ... but not emacs

[Mark G.]

Hey Everyone,

Thanks for the info on vim, I may try it out (or neovim) someday.
My take is that vi is a text editor, which I use to edit text.
That's all (for me).  If I want code highlighting or other
advanced features, I will use an integrated development
environment (IDE) style of editor.  Perhaps there is a
middle-ground use case for vim, but I don't really have any
in my day-to-day computing tasks.



On 4/27/26 06:49, Greg H wrote:
> It depends on what you consider essential.
> 
>  From what I recall *vim* supports a few features that *vi* did not:
> 
>   * Visual mode (v) - Once I started using this it quickly integrated into my normal workflow.
>   * Multi-level undo / redo.
>   * Syntax highlights
> 
> *Note* - I have been test driving *nvim* (neovim) as a replacement. Seems pretty good so far, but not as big a 
> difference as *vi *to *vim*.
> 
> On Sun, Apr 26, 2026 at 4:49 PM Craig Miller <cvmiller at gmail.com <mailto:cvmiller at gmail.com>> wrote:
> 
>     __
> 
>     Mark,
> 
>     On MX Linux vi is (round-about) connect to vim.tiny, which vim is also linked to. So there is no difference between
>     vi and vim.
> 
>       /usr/bin$ ls -l vi*
>     lrwxrwxrwx 1 root root      20 May  4  2023 vi -> /etc/alternatives/vi
>     lrwxrwxrwx 1 root root      22 Feb 14  2023 view -> /etc/alternatives/view
>     -rwxr-xr-x 1 root root   32288 Feb 28  2020 viewres
>     lrwxrwxrwx 1 root root       8 Sep 14  2024 vim -> vim.tiny
>     -rwxr-xr-x 1 root root    1082 Jul 14  2024 vimdot
>     -rwxr-xr-x 1 root root 1629584 Feb 15  2025 vim.tiny
>     -rwxr-xr-x 1 root root     239 Dec  8  2022 virtualenv
>     cvmiller at ohe /usr/bin$
>     cvmiller at ohe /usr/bin$
>     cvmiller at ohe /usr/bin$ ls -l /etc/alternatives/vi
>     lrwxrwxrwx 1 root root 17 May  4  2023 /etc/alternatives/vi -> /usr/bin/vim.tiny
> 
>     On Alpine Linux, vi is part of busybox (a multicall binary), and there is no vim by default.
> 
>     On PiOS (bookworm), there is vi, and no vim (be default).
> 
>     So I guess the answer is: "it depends"
> 
>     Craig....
> 
>     On 4/26/26 12:14, Mark G. wrote:
>>     Nice that it is patched.  I just noticed, however, that FreeBSD
>>     ships plain old vi, not vim.  Is vi a default in Linux, or is
>>     it vim instead?  Curious, are there essential features that
>>     vim has that makes it more useful than vi?
>>
>>
>>
>>
>>     On 4/24/26 07:49, Greg H wrote:
>>>     Here's the vim zero-day discussed last night:
>>>
>>>     https://www.csoonline.com/article/4153288/vim-and-gnu-emacs-claude-code-helpfully-found-zero-day-exploits-for-
>>>     both.html <https://www.csoonline.com/article/4153288/vim-and-gnu-emacs-claude-code-helpfully-found-zero-day-
>>>     exploits-for-both.html> <https://www.csoonline.com/article/4153288/vim-and-gnu-emacs-claude-code-helpfully-found-
>>>     zero-day-exploits-for-both.html> <https://www.csoonline.com/article/4153288/vim-and-gnu-emacs-claude-code-
>>>     helpfully-found-zero-day-exploits-for-both.html>
>>>
>>>     /“An attacker who can deliver a crafted file to a victim achieves arbitrary command execution with the privileges
>>>     of the user running Vim,” Vim maintainers noted in their security advisory <https://github.com/vim/vim/security/
>>>     advisories/ GHSA-2gmj-rpqf-pxvh> <https://github.com/vim/vim/security/advisories/GHSA-2gmj-rpqf-pxvh>. “The
>>>     attack requires only that the victim opens the file; no further interaction is needed.”/
>>>
>>>     I forgot to mention an emacs flaw was also discovered.
>>>
>>>     Greg
>>>
>>>