Given that most administrators use vim to edit everything in the system and often open random files, I would think vim is the most obvious thing to attack (just

Given that most administrators use vim to edit everything in the system and often open random files, I would think vim is the most obvious thing to attack (just like printers in corporate networks). Just do "set nomodeline" and move on. I've had it disabled for the past ~10 years because of previous CVEs like this (such as CVE-2007-2438).