Executive brief
Vim is a widely used open-source text editor. A vulnerability in its Python code completion feature allows a specially crafted file to execute malicious commands on a user's computer. If a user opens a hostile Python file and triggers the 'omni-completion' feature, an attacker could gain full control over the user's session and data.
Technical details
A code injection vulnerability exists in Vim's Python omni-completion scripts (python3complete.vim and pythoncomplete.vim). The get_code() method reconstructs function and class definitions from the current buffer and executes them using Python's exec() function to populate completion dictionaries. Because docstrings are inserted into this reconstructed source verbatim between triple quotes without escaping, an attacker can use embedded triple quotes to break out of the string literal and execute arbitrary Python code. Exploitation requires a user to open a malicious buffer and manually or automatically trigger omni-completion (e.g., via CTRL-X CTRL-O). This issue was addressed in patch 9.2.0699 by using repr() to properly quote docstrings.
Affected products
- Vim Vim < 9.2.0699
Timeline
- 2026-06-21: patched: Patch 9.2.0699 released
- 2026-06-21: advisory: GitHub Security Advisory GHSA-ppj8-wqjf-6fp3 published
- 2026-06-25: disclosed: CVE-2026-57456 published to NVD