Vim CVE-2026-59856

Exploitation requires that the victim (1) is running Vim before 9.2.0736 with the bundled PHP omni-completion script phpcomplete.vim present, (2) opens an attacker-controlled PHP file whose class or trait name contains a single quote plus injected Ex text (e.g. |:!command), and (3) actively invokes PHP omni-completion on that buffer - this active user interaction (UI:A) is the primary limiting factor. It is a local vector (AV:L): the malicious content must be loaded into the editor. Limiting factors: it only triggers for the PHP filetype via its omni-completion path, requires the user to manually request completion (it does not fire on mere file open), and is fully neutralized once upgraded to 9.2.0736 or once PHP omnifunc is disabled. No authentication is required (PR:N), but the mandatory manual completion step meaningfully constrains real-world exploitation.

The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H, score 8.4) reflects local attack surface with high confidentiality, integrity, and availability impact but mandatory active user interaction - the victim must both open the malicious PHP file and manually trigger omni-completion. This is not a remote, no-interaction worm-class flaw; it is a client-side social-engineering vector, more comparable to opening a booby-trapped document than to a network-facing RCE. No EPSS score, POC, or KEV status was provided, so no evidence of active or automated exploitation exists at this time; exploitation is plausible but requires targeting users who edit untrusted PHP files with omni-completion. The signals are internally consistent: local vector plus required interaction correctly tempers the otherwise-high impact. Real priority is moderate - high impact but gated behind user action and a non-trivial workflow (PHP editing with omni-complete), so it warrants prompt patching for developer workstations that handle untrusted PHP but is not an emergency for the general population.

An attacker crafts a PHP file in which a class or trait name embeds a single quote followed by a bar and an Ex command such as :!, then delivers it to a developer via a repository, email attachment, or shared project. The developer opens the file in a pre-9.2.0736 Vim and triggers PHP omni-completion, at which point the malicious name breaks out of the search() pattern and the injected :! command executes arbitrary shell commands under the victim's account. No public exploit is identified at time of analysis, and success depends on the local, interaction-required conditions in the CVSS 4.0 vector.