CVE-2026-52858 Details
Description
Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package's top-level code as the editing user. This issue has been patched in version 9.2.0561.
A vulnerability allowing arbitrary code execution has been identified in Vim versions prior to 9.2.0561. This issue arises in the Python omni-completion script within 'python3complete.vim' for Vim builds with the '+python3' interpreter, as well as in the legacy 'pythoncomplete.vim' for '+python' builds. The vulnerability occurs because the omni-completion feature executes 'import' and 'from' statements from the current buffer using Python's import system. Since the buffer's working directory is included in 'sys.path', this behavior can be exploited by opening a malicious .py file that contains a Python package, and then invoking omni-completion. This execution runs the package's top-level code as the user editing the file.
Users can update to Vim version 9.2.0561 or later, where this vulnerability has been patched. Instructions for downloading the latest version are available on the Vim GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vim vim | < 9.2.0561 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | Initial Analysis | [email protected] |
| Jun 11, 2026 | New CVE Received | [email protected] |