Vim's Omni-Completion feature for PHP fails to escape class or trait names that are read from the current buffer. A name containing a single quote can terminate the win_execute() argument early, letting attackers insert arbitrary Ex commands that are passed to :! and executed by the operating system. The resulting vulnerability allows an attacker who can open a crafted PHP file and invoke omni-completion to run arbitrary commands, compromising the confidentiality, integrity, and availability of the system running Vim.

The issue affects Vim versions prior to 9.2.0736, specifically the vim:vim product. The insecure PHP Omni-Completion script is located in runtime/autoload/phpcomplete.vim. Users who run older Vim releases on any platform that supports this feature are susceptible.

The CVSS score is 8.4, indicating high severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Because the flaw runs operating‑system commands with the user's privileges, exploitation can result in full remote command execution against the account running Vim. The attack requires a victim to edit a crafted PHP file and invoke omni-completion; based on the description, it is inferred that the likely attack vector is local or session‑based. The lack of published exploits does not diminish the risk; the flaw is straightforward to exploit once the conditions are met.