The vulnerability arises from how Vim's Python omni-completion reconstructs function and class definitions from the current buffer and passes them to exec(). Each docstring is inserted unchanged between triple quotes, with no escaping. A malicious buffer can therefore break out of the string literal and inject arbitrary Python code, which is executed during completion. The flaw is a code injection vulnerability (CWE‑94) that grants arbitrary code execution within the Vim process.

Ongoing Vim releases up through 9.2.0698, and earlier 9.1.x and 9.0.x versions, are affected. The problem is present in the autoload files python3complete.vim and pythoncomplete.vim, part of the default Vim runtime. All users running Vim with Python omni‑completion enabled are vulnerable unless they upgrade to version 9.2.0699 or later.

The CVSS score of 8.4 classifies this flaw as high severity, and while EPSS data is not available, the lack of a KEV listing does not reduce the risk of exploitation. An attacker who can influence the contents of a buffer that Vim will process for omnocompletion can trigger arbitrary code execution locally. The attack vector is likely local, but could be leveraged by an attacker who gains elevated privileges to run Vim as a privileged user.