Executive brief
Vim is a widely used open-source text editor. A vulnerability in its PHP auto-completion feature allows a specially crafted PHP file to execute malicious commands on a user's computer. If a user opens a malicious PHP file and triggers the 'omni-completion' feature (typically used for code suggestions), an attacker could gain full control over the user's system and data.
Technical details
A code injection vulnerability exists in the PHP omni-completion script (`runtime/autoload/phpcomplete.vim`) in Vim versions prior to 9.2.0736. The `phpcomplete#GetClassContentsStructure()` function interpolates class or trait names directly from the buffer into a `search()` pattern executed via `win_execute()` without proper escaping. By including a single quote and a pipe character (`|`) in a class name, an attacker can terminate the search string and execute arbitrary Ex commands. Exploitation requires the user to have filetype plugins enabled and to manually trigger omni-completion (CTRL-X CTRL-O) while editing a malicious PHP file. The issue is resolved in patch version 9.2.0736 by properly quoting the class name before interpolation.
Affected products
- Vim Vim < 9.2.0736
Timeline
- 2026-06-28: advisory: GitHub Security Advisory published
- 2026-07-09: disclosed: CVE-2026-59856 published to NVD
- 2026-07-09: patched: Fixed in version 9.2.0736