CVE-2026-59856: Vim PHP Omni-Completion Code Execution Vulnerability

Technical summary

The vulnerability exists in runtime/autoload/phpcomplete.vim, where class and trait names extracted from the edited buffer are interpolated directly into a search() pattern executed via win_execute() without proper escaping. An attacker can craft a PHP file containing a class or trait name with a single quote character. This quote terminates the search() string argument prematurely. Because the bar character (|) is honored as an Ex command separator in Vim, the remainder of the malicious name is interpreted as Ex commands. By embedding a :! command (which executes shell commands), arbitrary OS-level code execution is achieved when the victim invokes PHP omni-completion on the file. The attack surface is the completion mechanism, not the editor itself, limiting exposure to users who actively use PHP autocompletion.

Business impact

This vulnerability poses a moderate to significant risk for development teams and individual developers who use Vim as their primary editor, especially those working with PHP. An attacker can deliver a malicious PHP file via email, collaboration platforms, or code repositories, and compromise the developer's machine when they attempt to use Vim's helpful autocompletion feature. This could lead to theft of SSH keys, API tokens, source code, or lateral movement into internal networks. The attack is particularly insidious because it exploits a convenience feature and does not require the user to execute or run the PHP file—merely opening it and triggering completion is sufficient. Organizations relying on Vim for PHP development should prioritize patching to prevent supply-chain style attacks targeting their development workforce.

Affected systems

Vim versions prior to 9.2.0736 are vulnerable. The vulnerability is specific to the PHP omni-completion script (phpcomplete.vim) and therefore only impacts users who have this feature available and use it. All operating systems running vulnerable Vim versions are affected—Linux, macOS, and Windows are all vectors for exploitation, assuming Vim is installed and the user processes PHP files with omni-completion enabled.

Exploitability

Exploitability is moderate to high in practical scenarios. The attack requires user interaction (opening a PHP file and invoking completion), and the attacker has no way to force either action remotely. However, social engineering is straightforward: an attacker can include a crafted PHP file in a pull request, shared code snippet, or public repository, knowing that developers will naturally open and explore it. The single quote syntax is simple and does not require obfuscation. Once the conditions are met, code execution is reliable and runs with the privileges of the user running Vim. The CVSS score of 7.8 (HIGH) reflects the high impact (confidentiality, integrity, availability) offset by the requirement for user interaction and local attack vector.

Remediation

Upgrade Vim to version 9.2.0736 or later. This release patches the phpcomplete.vim script to properly escape class and trait names before interpolating them into search patterns, preventing the quote-injection attack. Users should verify the upgrade through their package manager or by downloading directly from the official Vim repository. No workaround is available for users unable to upgrade immediately; disabling PHP omni-completion or avoiding the use of Vim on untrusted PHP files reduces risk but is not a complete mitigation.

Patch guidance

Apply the patch by upgrading to Vim 9.2.0736 or newer. Most Linux distributions should offer this version through their standard package repositories; verify availability with `apt update && apt-cache policy vim` (on Debian/Ubuntu) or equivalent for your distribution. macOS users can upgrade via Homebrew (`brew upgrade vim`), and Windows users should download the latest installer from vim.org or upgrade through their preferred package manager. After patching, restart any running Vim instances. Given the low overhead of upgrading Vim and the straightforward patch, deployment should prioritize speed over staged rollout unless other dependencies require validation.

Detection guidance

Monitor for Vim processes opening PHP files from untrusted sources (external emails, downloads, temporary directories, or repository clones from unknown authors). Log or alert on invocations of the omni-completion feature (triggered via Ctrl-X Ctrl-O in insert mode) on suspicious files. Host-based detection could flag shell command execution (via :! or system() calls) spawning from a Vim process, though this will generate noise in development environments. Network detection is limited since the attack is entirely local; endpoint detection and response (EDR) tools should focus on anomalous process execution spawned by Vim or unusual file access from the editor process.

Why prioritize this

This vulnerability should be prioritized for patching in organizations with active Vim-using PHP developers. While the attack requires user interaction, the attack surface is subtle and exploitable via common collaboration workflows (pull requests, code reviews, repository cloning). The CVSS score of 7.8 and the potential for credential theft or supply-chain impact justify rapid patching. The ease of remediation (a simple version bump) and the absence of known active exploitation in the wild suggest a measured but timely approach rather than emergency response. Developers and security teams should communicate the risk and patch availability to reduce user friction during rollout.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: (1) High impact across confidentiality, integrity, and availability—arbitrary code execution can exfiltrate data, modify files, or disrupt services; (2) Local attack vector and no privilege requirement—any unprivileged user can trigger the vulnerability; (3) User interaction required—the victim must open the file and invoke completion, reducing the attack surface compared to a network-based or no-interaction vulnerability; (4) Unchanged scope—the compromise is limited to the user's local context, not system-wide. The score appropriately captures the severity while accounting for the requirement to socially engineer a user into opening a file.

Frequently asked questions