CVE-2026-52858

UNKNOWN 0.0

Vim: Arbitrary Code Execution via Python Omni-Completion

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package's top-level code as the editing user. This issue has been patched in version 9.2.0561.

CWE	CWE-94 CWE-95 CWE-829
Vendor	vim
Product	vim
Published	Jun 11, 2026

Stay Ahead of the Next One

Get instant alerts for vim vim

Be the first to know when new unknown vulnerabilities affecting vim vim are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

vim / vim

< 9.2.0561

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c github.com: https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d github.com: https://github.com/vim/vim/releases/tag/v9.2.0561