OS command injection in Vim :find completion

This repository is a real local/file-based exploit reproduction environment for CVE-2026-44656, a Vim modeline command injection issue. The exploit abuses backtick expansion inside the 'path' option set from a file modeline. When a user opens the crafted file and invokes ':find' completion with Tab, Vim evaluates the backtick expression and executes an attacker-controlled command. Repository structure is simple despite bundling a large upstream Vim source tree. The meaningful exploit components are: (1) 'poc.txt', which contains the malicious modeline `// vim: set path=.,`./eval.sh` :`; (2) 'eval.sh', a shell payload that runs `touch ./sakana.pwn`; (3) 'Dockerfile', which builds a Debian-based container, compiles the included vulnerable Vim source, and stages the PoC files; and (4) README files documenting reproduction. The 'vim/' directory is mostly upstream Vim source/runtime content used to build the vulnerable target, not custom exploit logic. Main exploit capability: arbitrary command execution as the local Vim user. There are no C2, remote callbacks, or network targets in the exploit itself. The trigger is user interaction with a malicious file plus Tab completion in ':find'. The payload is basic and hardcoded, so maturity is OPERATIONAL rather than weaponized. The exploit is not merely a detector; it demonstrates code execution by creating a local marker file.