Loading story…
Vim disclosed two medium-severity local code execution flaws in its Python omni-completion feature that can run attacker-controlled code when a user opens a malicious Python file and manually triggers completion, such as with CTRL-X CTRL-O. The first issue affects versions before 9.2.0561 and stems from the completer re-executing harvested import statements, which can load attacker-controlled sibling modules from the working directory in builds compiled with +python3 or legacy +python and with filetype plugins enabled. Vim fixed that behavior in patch 9.2.0561 by disabling execution of harvested imports by default and allowing trusted users to re-enable it with g:pythoncomplete_allow_import = 1.
A second flaw, later assigned CVE-2026-52860, affects versions before 9.2.0597 and bypasses that earlier mitigation because Vim reconstructs Python function and class definitions from the current buffer and executes them with exec(). That allows attacker-controlled default values, annotations, and class base expressions to run inside the user's Vim process when omni-completion is invoked, including by plugins that call the completion function. Vim said the issue does not affect builds without Python support and released patch 9.2.0597; the disclosures credit tonghuaroot for the earlier bug and DavidCarliez for reporting and analyzing the later exec()-based issue.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Vim disclosed a second medium-severity arbitrary code execution vulnerability affecting versions earlier than 9.2.597, where Python omni-completion reconstructs definitions from the current buffer and executes them with exec(), allowing attacker-controlled expressions to run. The issue was fixed in patch v9.2.597, and the advisory noted the earlier g:pythoncomplete_allow_import mitigation did not prevent this attack path.
A medium-severity arbitrary local code execution vulnerability in Vim's Python omni-completion was disclosed for versions prior to 9.2.0561. Vim fixed the issue in patch v9.2.0561 by disabling execution of harvested import statements by default, and credited GitHub user tonghuaroot with reporting, analysis, a proof of concept, and a suggested fix.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcegithub.com
Open sourceseclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2026-59858** allows arbitrary code execution in **Vim** versions earlier than `9.2.0735` through the editor's C omni-completion feature. The flaw resides in `runtime/autoload/ccomplete.vim`, where unescaped tag data is inserted into a `:vimgrep` pattern and executed with `:execute`. An attacker can abuse a crafted `tags` entry so that, when a user opens a malicious `.c` file and triggers C omni-completion, injected **Ex commands** run with the privileges of the editing user. Vim addressed the issue in patch **9.2.0735**, which escapes the typename before constructing the `:vimgrep` command and blocks special characters such as `/` and `|` from breaking out of the pattern. The fix was committed in `6b611b0d15603c52ebdad17172b0232b4f65704e` and includes regression tests to confirm that malicious `typeref` values no longer execute commands while normal struct-member completion continues to function.
Jul 10, 2026
A high-severity vulnerability tracked as **CVE-2026-59856** allows arbitrary code execution in Vim’s PHP omni-completion feature. In Vim versions prior to **9.2.0736**, the `runtime/autoload/phpcomplete.vim` script inserted a class or trait name from an edited PHP buffer into a `search()` pattern that was then executed through `win_execute()` without proper escaping. A crafted PHP file containing a malicious name with a quote and Ex command separator could break out of the intended pattern and trigger arbitrary Ex commands, including operating-system command execution via `:!`, when a user opened the file and invoked omni-completion.
Jul 10, 2026
German CERT advisories identified **code execution vulnerabilities** in `vim`, the widely used text editor, in two separate notices. The advisories, `2026-0782` and `2026-0886`, both describe flaws that could allow an attacker to execute code, indicating ongoing security issues affecting the application. The notices provide limited public detail, but the repeated classification of the issue as code execution highlights potential risk for systems where `vim` is installed or used to process untrusted content. Organizations using `vim` should review the associated advisories, determine affected versions in their environments, and prioritize vendor patches or other mitigations as they become available.
Jun 29, 2026