SB2026062216 - Code Injection in Vim

Description

This security bulletin contains information about 1 vulnerability.

1) Code Injection (CVE-ID: N/A)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper control of code generation in Python omni-completion docstring handling in runtime/autoload/python3complete.vim and pythoncomplete.vim when processing a hostile Python buffer during omni-completion. A remote attacker can craft a malicious docstring and convince a user to trigger Python omni-completion to execute arbitrary code.

User interaction is required to open or edit a hostile Python buffer and trigger Python omni-completion. Only builds with +python3 or +python support are affected.

Remediation

Install update from vendor's website.

References

• https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3
• https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8