Quick answers
- Is CVE-2026-57456 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-57456 being exploited in the wild.
- How severe is CVE-2026-57456?
- Informational severity, with a CVSS score of 8.4, published 25 June 2026.
- Which products and versions are affected?
- Vim < 9.2.0699.
- Is there a fix for CVE-2026-57456?
- A patch was published on 2026-06-21: Patch 9.2.0699 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-57456 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-57456?
- Check whether you run Vim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A code injection vulnerability exists in Vim's Python omni-completion scripts (python3complete.vim and pythoncomplete.vim). The get_code() method reconstructs function and class definitions from the current buffer and executes them using Python's exec() function to populate completion dictionaries. Because docstrings are inserted into this reconstructed source verbatim between triple quotes without escaping, an attacker can use embedded triple quotes to break out of the string literal and execute arbitrary Python code. Exploitation requires a user to open a malicious buffer and manually or automatically trigger omni-completion (e.g., via CTRL-X CTRL-O). This issue was addressed in patch 9.2.0699 by using repr() to properly quote docstrings.
Affected products
- Vim Vim < 9.2.0699
Timeline
- 2026-06-21: patched: Patch 9.2.0699 released
- 2026-06-21: advisory: GitHub Security Advisory GHSA-ppj8-wqjf-6fp3 published
- 2026-06-25: disclosed: CVE-2026-57456 published to NVD