CVE-2026-52860: Vim Python Omni-Completion Arbitrary Code Execution

Technical summary

CVE-2026-52860 involves improper handling of Python code evaluation in Vim's omni-completion mechanism. The vulnerability exists in the reconstruction and execution of function and class definitions extracted from the buffer. Python's evaluation model processes default parameter values, annotations, and base class expressions at definition time (not at call time). When Vim's pythoncomplete plugin uses exec() to populate the completion dictionary with reconstructed definitions, these expressions are evaluated in that context, allowing arbitrary Python code execution. The prior mitigation g:pythoncomplete_allow_import (GHSA-52mc-rq6p-rc7c) specifically blocked import/from statements but does not prevent code injection through default arguments or annotations, leaving this attack surface unprotected. The vulnerability affects Vim versions prior to 9.2.0597, which introduced patched behavior.

Business impact

This vulnerability poses a significant supply-chain and endpoint risk. Developers and system administrators who work with untrusted or downloaded Vim configuration files, code repositories, or documentation files face code-execution risk during routine editing workflows. An attacker could distribute malicious .vim files, inject hostile code into popular repositories, or socially engineer users into opening weaponized files. Successful exploitation grants the attacker the full privilege level of the user running Vim, potentially leading to credential theft, lateral movement, intellectual property theft, or system compromise. The low barrier to exploitation (simply opening a file and triggering completion) amplifies risk in collaborative development environments.

Affected systems

This vulnerability affects Vim versions prior to 9.2.0597. The specific scope includes any Vim installation with Python omni-completion enabled (the pythoncomplete plugin). Affected platforms include Linux, macOS, and Windows systems running vulnerable Vim builds. Systems using Vim as their primary or secondary editor for code development, documentation, or configuration management are most exposed. Note that the vulnerability requires local user interaction (opening a file and triggering Python completion), so remote attacks are not viable, but local or supply-chain delivery mechanisms are practical.

Exploitability

Exploitability is high relative to the attack surface. No authentication is required; the attacker needs only to deliver a malicious file to a user's filesystem and wait for that user to open it in Vim and trigger Python omni-completion (e.g., via Ctrl+X Ctrl+O in insert mode). No special Vim configuration is required beyond default Python completion enablement. The attack is reliable and deterministic: Python's evaluation semantics guarantee that default arguments and annotations will be processed. However, successful exploitation does depend on user interaction—the user must explicitly trigger completion or have it auto-triggered by a plugin—which provides a modest friction point.

Remediation

Upgrade Vim to version 9.2.0597 or later. This version patches the vulnerability by altering how reconstructed Python definitions are handled to prevent arbitrary code execution during completion. Users unable to upgrade immediately should disable Python omni-completion by setting let g:pythoncomplete_allow_import = 0 in their .vimrc, though note that this specific mitigation does not fully address this vulnerability (it blocks imports but not the parameter/annotation evaluation path). Additionally, exercise caution when opening Vim files from untrusted sources, and review downloaded .vimrc files and plugins before use.

Patch guidance

Verify the Vim version in use with :version in the editor. Users on version 9.2.0597 or later are patched. Update mechanisms vary by platform: Linux users should update via their distribution's package manager; macOS users via Homebrew or MacPorts; Windows users via the official Vim releases or platform-specific installers. Verify the installed version post-update. Because omni-completion is a common feature, patching should be prioritized for development systems and any machines that edit code from external sources.

Detection guidance

Monitor Vim process execution and Python subprocess spawning on development systems, particularly when triggered from the pythoncomplete plugin. Log or alert on exec() calls from Vim's Python environment with unusual or suspicious code. In a defensive posture, network-based detection is limited because the vulnerability is local; however, endpoint detection and response (EDR) tools can monitor for suspicious child processes spawned by Vim or unusual Python execution contexts. Behavioral indicators include Vim triggering Python interpreters with unexpected arguments or Vim spawning shells or network tools. Scan for .vimrc or plugin files containing suspicious Python function definitions with obfuscated default arguments or annotations.

Why prioritize this

This vulnerability merits immediate patching priority due to its high CVSS score (7.8), arbitrary code execution impact, and practical exploitability in development workflows. The low interaction barrier (simply opening and completing code) and potential for supply-chain delivery through code repositories or plugin repositories make it a realistic attack vector in collaborative environments. While KEV status is not active, the vulnerability's novelty and the widespread use of Vim in security-sensitive roles justify urgent remediation.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects attack vector Local, Attack Complexity Low, Privileges Required None, User Interaction Required, Scope Unchanged, and full impact on Confidentiality, Integrity, and Availability. The score appropriately captures the severity: arbitrary code execution in the context of the user running Vim, no privilege elevation required by the attacker, and straightforward attack mechanics. The Local attack vector prevents remote exploitation, preventing a Critical rating, but the ease of execution and severe impact justify a HIGH severity classification.

Frequently asked questions