CVE-2026-52858
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Vim prior to version 9.2.0561 has a security issue related to executing code from malicious .py files when using Python's omni-completion feature. As a result, malicious code can be run in the context of the editing user.
Risk Assessment
Organizations may be exposed to the execution of malicious code, potentially leading to unauthorized access to systems or data. Users may inadvertently run dangerous code, increasing the risk of attacks.
Recommendation
It is recommended to update Vim to version 9.2.0561 or later to mitigate this vulnerability. Additionally, avoid opening unknown or suspicious .py files in the editor.
Other vulnerabilities in Vim
See all- CVE-2017-11109High
Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file.
- CVE-2016-1248High
Vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax', and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.
- CVE-2024-43802Medium
Vim is an improved version of the Unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. This may lead to the tb_off position within the buffer being out of bounds.
- CVE-2024-47814Low
In Vim before 9.1.0764, a use-after-free occurs when closing a buffer and a BufWinLeave auto command reopens the same buffer in a new split window.
- CVE-2026-34714Critical
A vulnerability in Vim before version 9.2.0272 allows immediate code execution upon opening a crafted file in the default configuration. The issue is due to %{expr} injection in tabpanel lacking the P_MLE flag.
- CVE-2017-6350Critical
An integer overflow at an unserialize_uep memory allocation site occurs for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.
- CVE-2017-6349Critical
An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.
- CVE-2017-5953Critical
Vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.
- CVE-2026-43961High
Vim's netrw plugin contains a vulnerability that allows arbitrary Vimscript execution via a crafted filename with quote characters and expression fragments. This can lead to shell command execution with the privileges of the user running Vim.
- CVE-2026-73073High
Vim prior to 9.2.0845 has a vulnerability in StructMembers() in runtime/autoload/ccomplete.vim, which constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.
Original NVD description (English source)
Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package's top-level code as the editing user. This issue has been patched in version 9.2.0561.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS