CVE-2026-57456 Details

A vulnerability in Vim's Python omni-completion feature, present in versions prior to 9.2.0699, allows for arbitrary code execution. This occurs because the omni-completion process executes reconstructed function and class definitions from the current buffer using 'exec()'. During this reconstruction, docstrings are inserted verbatim between triple quotes without any escaping. As a result, a maliciously crafted buffer can break out of the triple-quoted literal and execute attacker-controlled Python code. The vulnerability is rooted in the way docstrings are handled, particularly in class definitions, where an embedded triple quote can escape the string literal and execute code when the 'exec()' function is called.

Users can upgrade to Vim version 9.2.0699 or later, where this vulnerability has been fixed.