CVE-2026-52858: Vim Python Omni-Completion Code Execution Vulnerability

Technical summary

The python3complete.vim (and legacy pythoncomplete.vim) completion scripts in Vim evaluate Python import and from statements extracted from the current buffer through Python's import machinery. Since the buffer's directory is inserted into sys.path at runtime, a crafted .py file paired with a malicious sibling package will execute that package's __init__.py code during completion. This violates the principle of safe code editing: opening a file should not execute untrusted code. The vulnerability affects Vim builds compiled with +python3 (primary) or +python (legacy) interpreters. The fix, released in version 9.2.0561, restricts the completion mechanism to avoid unsafe imports.

Business impact

For security teams, this represents a supply-chain-adjacent risk: developers using Vim as their editor could be compromised while reviewing or working with untrusted code repositories. A malicious pull request containing a hostile .py file with a sibling package could silently execute attacker code on a developer's machine. This is particularly concerning in open-source project reviews where code examination is a routine task. The impact is confined to users with Vim installed and the vulnerable completion feature enabled, but those users face complete local compromise (credential theft, malware installation, or lateral movement).

Affected systems

Vim versions prior to 9.2.0561 with +python3 or +python interpreter support are vulnerable. The vulnerability requires the omni-completion feature to be invoked (typically via Ctrl-X Ctrl-O or equivalent keybinding). Linux, macOS, and Windows installations are all affected. Users running Vim without Python support, or those who never trigger omni-completion, are not at risk. Distributions and package managers should prioritize patching this in their Vim packages, as many ship with Python support enabled by default.

Exploitability

Exploitability is moderate in direct attack scenarios: an attacker must trick a user into opening a crafted .py file and then trigger code completion—both user actions are required. However, in supply-chain contexts (malicious open-source repositories, forked projects, or CI/CD artifact analysis), the barrier is lower. An attacker with repository access can commit the malicious structure, and any reviewer or developer pulling the code faces automatic execution risk. No special privileges or network access are needed; the attack is entirely local. The CVSS score of 7.8 reflects high integrity and confidentiality impact balanced against the local, user-interaction requirement.

Remediation

Upgrade Vim to version 9.2.0561 or later. For users unable to patch immediately, mitigations include: disabling Python omni-completion by modifying your .vimrc (e.g., removing or commenting out python3complete plugin settings), disabling the +python3 feature at compile time if self-building Vim, and practicing caution when opening untrusted .py files—avoid triggering code completion on hostile code. Verify patch deployment against the official Vim release notes and your distribution's package repositories.

Patch guidance

Consult your Vim distribution or package manager for version 9.2.0561 or later. Official Vim releases are available at vim.org. Linux distributions (Debian, Ubuntu, Fedora, etc.) should publish updates through their standard channels; check your package manager for available upgrades. macOS users via Homebrew should run `brew upgrade vim`. Windows users should download the latest installer or portable build from vim.org. After patching, restart Vim or any running instances to load the fixed completion scripts.

Detection guidance

Check Vim version with `:version` inside Vim or `vim --version` from the command line; confirm version 9.2.0561 or later and that python3 support is compiled in. Review your .vimrc for any custom omni-completion configurations that might bypass the fix. Monitor for unexpected child processes spawned during Vim sessions, particularly Python processes, which could indicate exploitation attempts. Endpoint detection and response (EDR) tools should flag suspicious Python executions spawned from a Vim process in unusual working directories.

Why prioritize this

This vulnerability should be prioritized for patching in environments where developers regularly work with untrusted or external code repositories. The local+user-interaction requirement lowers urgency compared to remote exploits, but the high impact (arbitrary code execution) and plausible supply-chain scenarios elevate it above routine patches. Teams heavily engaged in open-source contribution, security research, or code review workflows face elevated risk and should patch first.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector Local (no network required), Attack Complexity Low (straightforward exploitation once triggered), Privileges Required None (runs as the editing user), User Interaction Required (must invoke omni-completion), Scope Unchanged (no privilege escalation beyond the user), but high Confidentiality, Integrity, and Availability impact (arbitrary code execution). The score is not critical because local access and user action are prerequisites; however, in targeted supply-chain attacks, these barriers may be easily overcome.

Frequently asked questions