Vim CVE-2026-52858

The target Vim build must be compiled with +python3 (or legacy +python), and the user must have Python omni-completion configured for Python files (typically 'set omnifunc=python3complete#Complete', which many Python plugin bundles and distro defaults enable). The victim must open an attacker-controlled .py file whose buffer directory contains a malicious sibling Python package or module, and must then invoke omni-completion (Ctrl-X Ctrl-O or equivalent) on that buffer. Limiting factors: requires explicit user interaction (opening the file and triggering completion - exploitation does not occur on mere file open), Vim version below 9.2.0561, Python interpreter linked into the Vim build, and an attacker-influenced working directory; on patched Vim, exploitation additionally requires the user to have manually set g:pythoncomplete_allow_import=1.

Real-world risk is moderate and skewed toward developer/CI workstations rather than servers. The CVSS 4.0 vector AV:N/AC:L/AT:P/PR:L/UI:A reflects that the network vector is only the file delivery channel (e.g., cloning a hostile repo) and exploitation requires the victim to actively open the .py file and trigger omni-completion (UI:A, AT:P) while already having local Vim session privileges (PR:L). There is no EPSS score, no KEV listing, and no POC in the provided intelligence, so this is best treated as a credible but not actively exploited supply-chain-style threat against developers who routinely browse untrusted Python repositories in Vim. The high VC/VI/VA impact is justified - arbitrary Python runs as the user, so SSH keys, source trees and tokens are all reachable. Note that the assessed CVSS 4.0 vector lists PR:L while the description implies no prior Vim authentication is needed beyond local user session; PR:L here appears to encode 'attacker-supplied file needs to land where the user opens it,' which is debatable - defenders should not assume strict pre-auth requirements. Risk is highest for anyone reviewing untrusted Python projects (security researchers, code-review platforms, CTF participants).

An attacker publishes a Python repository (e.g., on GitHub, PyPI source tarball, or a CTF challenge bundle) containing a benign-looking script demo.py with 'import helpers' at the top, plus a sibling helpers/__init__.py whose top-level code spawns a reverse shell or exfiltrates ~/.ssh/id_rsa. A developer clones the repo, opens demo.py in Vim, and types <C-x><C-o> while the cursor is near 'helpers.' to autocomplete; python3complete.vim re-executes the import line, Python loads helpers/__init__.py from the buffer's directory, and the payload runs as the developer. No public exploit is identified at time of analysis, but the patch comments and advisory describe the trigger path in enough detail for a working POC to be constructed quickly.