CVE-2026-52860

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-52860
Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluates function default values, parameter annotations, and class base expressions at definition time, so a hostile buffer can execute attacker-controlled Python expressions during omni-completion. The existing g:pythoncomplete_allow_import mitigation (GHSA-52mc-rq6p-rc7c) does not cover this path, because the attacker-controlled code is not a harvested import/from statement. This issue has been patched in version 9.2.0597.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/vim/vim/commit/c8c63673bc4253212820626aeeb75999d9a539d2 Patch
https://github.com/vim/vim/releases/tag/v9.2.0597 Product
https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c Mitigation Vendor Advisory
https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*
History

15 Jun 2026, 13:24

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : 7.8

15 Jun 2026, 13:09

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
References () https://github.com/vim/vim/commit/c8c63673bc4253212820626aeeb75999d9a539d2 - () https://github.com/vim/vim/commit/c8c63673bc4253212820626aeeb75999d9a539d2 - Patch
References () https://github.com/vim/vim/releases/tag/v9.2.0597 - () https://github.com/vim/vim/releases/tag/v9.2.0597 - Product
References () https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c - () https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c - Mitigation, Vendor Advisory
References () https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468 - () https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468 - Vendor Advisory
First Time Vim vim
Vim
CPE cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*

11 Jun 2026, 19:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-11 19:16

Updated : 2026-06-15 13:24

NVD link : CVE-2026-52860

Mitre link : CVE-2026-52860

CVE.ORG link : CVE-2026-52860

JSON object : View

Products Affected

vim

  • vim
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')