CVE-2026-59858: Vim C Omni-Completion Command Injection Vulnerability

Technical summary

The vulnerability exists in runtime/autoload/ccomplete.vim, which handles C omni-completion. The script constructs a :vimgrep pattern by interpolating the typeref: or typename: extension fields from tags file entries without proper escaping. Because :vimgrep interprets the pipe character (|) as a command separator when executed via :execute, a crafted tags entry can close the search pattern prematurely and append arbitrary Ex commands. This allows code execution in the context of the Vim process when C omni-completion is invoked. The root cause is insufficient input validation and escaping of tag field data before use in command construction.

Business impact

This vulnerability primarily affects developers and security researchers who work with C projects. The attack requires user interaction—opening a hostile C file and manually triggering code completion—making it unlikely to be exploited at scale through automated mechanisms. However, in collaborative development environments or when code is checked out from untrusted repositories, a malicious tags file could enable supply-chain or insider-threat scenarios. The impact is confined to the user's local machine and their privilege level; there is no network propagation or privilege escalation component.

Affected systems

Vim versions prior to 9.2.0735 are vulnerable. The vulnerability is triggered only when: (1) the user opens a .c file, (2) that file's project contains a malicious tags file, and (3) the user invokes C omni-completion (typically via Ctrl+X Ctrl+O or other completion triggers). All operating systems running vulnerable Vim versions are in scope, but Windows, macOS, and Linux desktop environments where developers actively use Vim are the primary concern.

Exploitability

The attack requires low technical sophistication—crafting a malicious tags entry is straightforward—but has moderate barriers to deployment. An attacker must successfully introduce a hostile tags file into a project the target will check out or work with. The user must also actively invoke code completion, which is a common developer action but not automatic. There is no remote exploitation vector; the attack is local and requires user interaction. The CVSS 3.1 score of 7.8 (HIGH) reflects high impact (code execution as the editing user) balanced against low attack complexity and local-only attack surface.

Remediation

Update Vim to version 9.2.0735 or later. For organizations managing Vim deployments, verify the installed version and apply updates through your package manager or vendor release channels. Until patching is possible, avoid working with C projects from untrusted sources or validate tags files before use. If C omni-completion is not required, it can be disabled in your Vim configuration.

Patch guidance

Vim 9.2.0735 and later contain the fix. Verify your installed version with :version in Vim. For most Linux distributions, update via your package manager (apt, yum, brew, etc.). Windows users should download the latest installer from vim.org or use a Windows package manager like Chocolatey. Macintosh users can update via Homebrew or MacPorts. Test the updated version against your typical C project workflows to confirm compatibility before rolling out organization-wide.

Detection guidance

Monitor Vim process execution and file access patterns in development environments. Logs showing Vim opening .c files followed by unexpected subprocess spawning or file modifications are potential indicators. Review tags files in C projects for unusual syntax, particularly entries with pipe characters in extension fields. Automated scanning of tags files for suspicious typeref: or typename: entries can flag potentially malicious content before it is executed.

Why prioritize this

While the CVSS score is HIGH and code execution is possible, the practical risk is moderate due to strict preconditions: local-only attack, user interaction required, and need to plant a malicious tags file. Prioritize patching development workstations and build servers used by teams that work with untrusted or third-party C code. Standard development machines in isolated environments face lower risk but should still be updated as part of normal maintenance cycles.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects: (1) HIGH impact—successful exploitation results in code execution as the editing user with full integrity and confidentiality compromise; (2) LOW attack complexity—no special conditions or tools are required to craft an exploit; (3) LOCAL attack vector—only local access and user interaction enable the attack; (4) REQUIRED user interaction—the user must manually invoke code completion. The HIGH severity classification is appropriate for code execution vulnerabilities, but the local-only and user-interaction requirements prevent a CRITICAL rating.

Frequently asked questions