Code Injection in Vim - CVE-2026-52860

Vulnerability identifier: #VU133463

CSH Severity: Medium

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-52860

CWE-ID: CWE-94

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to improper control of code generation in Python omni-completion in runtime/autoload/python3complete.vim and pythoncomplete.vim when reconstructing and executing function and class definitions from a hostile Python buffer during omni-completion. A local user can trick the victim into opening or editing a crafted Python buffer and triggering omni-completion to execute arbitrary code.

Only builds with +python3 or +python are affected, and triggering omni-completion in the hostile buffer is required.

Vim
Ubuntu
openEuler
Anolis OS
vim (Ubuntu package)
vim-common
vim-X11
vim
vim-filesystem
vim-minimal
vim-enhanced
vim-debuginfo
vim-debugsource
vim-data
vim-doc

Install security update from vendor's website.

Vim - update to 9.2.0597
vim (Ubuntu package) - addressed in versions 2:7.4.052-1ubuntu3.1+esm29, 2:7.4.1689-3ubuntu1.5+esm35, 2:8.0.1453-1ubuntu1.13+esm20, 2:8.1.2269-1ubuntu5.32+esm8, 2:8.2.3995-1ubuntu2.32, 2:9.1.0016-1ubuntu7.16, 2:9.1.0967-1ubuntu6.7, 2:9.1.2141-1ubuntu4.5
vim-common - addressed in versions 9.0-50, 9.0.2092-36
vim-X11 - addressed in versions 9.0-50, 9.0.2092-36
vim - addressed in versions 9.0-50, 9.0.2092-36
vim-filesystem - addressed in versions 9.0-50, 9.0.2092-36
vim-minimal - addressed in versions 9.0-50, 9.0.2092-36
vim-enhanced - addressed in versions 9.0-50, 9.0.2092-36
vim-debuginfo - addressed in versions 9.0-50, 9.0.2092-36
vim-debugsource - addressed in versions 9.0-50, 9.0.2092-36
vim-X11 - update to 9.0.2092-19
vim-common - update to 9.0.2092-19
vim-enhanced - update to 9.0.2092-19
vim-minimal - update to 9.0.2092-19
vim-data - update to 9.0.2092-19
vim-doc - update to 9.0.2092-19
vim-filesystem - update to 9.0.2092-19

• https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468
• https://github.com/vim/vim/commit/c8c63673bc4253212820626aeeb75999d9a539d2

• Code Injection in Vim
• Ubuntu update for vim
• openEuler 24.03 LTS SP3 update for vim
• openEuler 24.03 LTS SP1 update for vim
• openEuler 22.03 LTS SP4 update for vim
• openEuler 20.03 LTS SP4 update for vim
• Anolis OS update for vim