CVE-2026-52860 - Vulnerability Details

- Vim: Arbitrary Code Execution via Python Omni-Completion

Description

Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluates function default values, parameter annotations, and class base expressions at definition time, so a hostile buffer can execute attacker-controlled Python expressions during omni-completion. The existing g:pythoncomplete_allow_import mitigation (GHSA-52mc-rq6p-rc7c) does not cover this path, because the attacker-controlled code is not a harvested import/from statement. This issue has been patched in version 9.2.0597.

Published: 2026-06-11

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Vim executes Python code through exec() when generating omni-completion definitions, allowing an attacker to embed malicious Python expressions in a buffer that are evaluated when completion is requested. This results in arbitrary code execution governed by CWE‑94. The vulnerability can compromise confidentiality, integrity, and availability of the system running Vim.

Affected Systems

Vim versions before 9.2.0597 are affected. The issue exists in all Vim builds where Python omni-completion is enabled, regardless of the operating system or architecture.

Risk and Exploitability

The CVSS score is 7.5, indicating a high severity, but the EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting no widespread observed exploitation. The attack likely requires the user to open a specially crafted buffer and trigger omni-completion, so it is a local privilege user exploit that can lead to full code execution under the current user’s privileges. Local users with write access to a buffer can abuse this flaw, and if the user has elevated rights, the attacker could gain higher privileges.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

vim

affected

Version	Status	Constraints
`< 9.2.0597`	affected	—

Configuration 1 [-]

cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions

Vim

100%

Version	Status	Scheme	Platform
`[0,9.2.0597)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Vim to version 9.2.0597 or later to receive the official fix.
If an upgrade is not immediately possible, disable Python omni-completion by removing the omni function or setting the Python completion options to off, preventing exec() from being invoked.
Avoid opening or editing buffers containing untrusted Python code until the update is applied.

Generated by OpenCVE AI on June 11, 2026 at 22:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8451-1	Vim vulnerabilities

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00224.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/vim/vim/commit/c8c63673bc4253212820626aeeb75999d9a539d2
https://github.com/vim/vim/releases/tag/v9.2.0597
https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c
https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468
https://nvd.nist.gov/vuln/detail/CVE-2026-52860
https://www.cve.org/CVERecord?id=CVE-2026-52860

History

Fri, 19 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-52860 https://www.cve.org/CVERecord?id=CVE-2026-52860
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 15 Jun 2026 13:30:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`

Mon, 15 Jun 2026 13:15:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:vim:vim::::::::
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`

Fri, 12 Jun 2026 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 11 Jun 2026 21:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Vim Vim vim
Vendors & Products		Vim Vim vim

Thu, 11 Jun 2026 19:00:00 +0000

Type	Values Removed	Values Added
Description		Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluates function default values, parameter annotations, and class base expressions at definition time, so a hostile buffer can execute attacker-controlled Python expressions during omni-completion. The existing g:pythoncomplete_allow_import mitigation (GHSA-52mc-rq6p-rc7c) does not cover this path, because the attacker-controlled code is not a harvested import/from statement. This issue has been patched in version 9.2.0597.
Title		Vim: Arbitrary Code Execution via Python Omni-Completion
Weaknesses		CWE-94
References		https://github.com/vim/vim/commit/c8c63673bc4253212820626aeeb75999d9a539d2 https://github.com/vim/vim/releases/tag/v9.2.0597 https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468
Metrics		cvssV4_0 `{'score': 7.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Vim Vim

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-06-11T18:33:45.838Z

Updated: 2026-06-30T12:09:47.119Z

Reserved: 2026-06-08T18:41:27.725Z

Link: CVE-2026-52860

Vulnrichment

Updated: 2026-06-30T03:20:42.349Z

NVD

Status : Analyzed

Published: 2026-06-11T19:16:47.773

Modified: 2026-06-15T13:24:42.873

Link: CVE-2026-52860

Redhat

Severity : Important

Publid Date: 2026-06-11T18:33:45Z

Links: CVE-2026-52860 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-11T22:30:09Z

Weaknesses

CWE-94
Improper Control of Generation of Code ('Code Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object