diff --git a/plugins/sudoers/policy.c b/plugins/sudoers/policy.c
index d4be26491..d675d2fd4 100644
--- a/plugins/sudoers/policy.c
+++ b/plugins/sudoers/policy.c
@@ -88,10 +88,11 @@ parse_bool(const char *line, int varlen, int *flags, int fval)
 int
 sudoers_policy_deserialize_info(void *v)
 {
+    const int edit_mask = MODE_EDIT|MODE_IGNORE_TICKET|MODE_NONINTERACTIVE;
     struct sudoers_open_info *info = v;
-    char * const *cur;
     const char *p, *errstr, *groups = NULL;
     const char *remhost = NULL;
+    char * const *cur;
     int flags = 0;
     debug_decl(sudoers_policy_deserialize_info, SUDOERS_DEBUG_PLUGIN);
 
@@ -348,6 +349,12 @@ sudoers_policy_deserialize_info(void *v)
 #endif
     }
 
+    /* Sudo front-end should restrict mode flags for sudoedit. */
+    if (ISSET(flags, MODE_EDIT) && (flags & edit_mask) != flags) {
+	sudo_warnx(U_("invalid mode flags from sudo front end: 0x%x"), flags);
+	goto bad;
+    }
+
     user_gid = (gid_t)-1;
     user_sid = (pid_t)-1;
     user_uid = (gid_t)-1;