Is CVE-2026-59856 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59856 being exploited in the wild.

How severe is CVE-2026-59856?

Informational severity, with a CVSS score of 8.4, published 9 July 2026.

Is there a fix for CVE-2026-59856?

A patch was published on 2026-07-09: Fixed in version 9.2.0736 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59856 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-59856?

Check whether you run Vim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59856: Vim command injection in PHP omni-completion

CVE-2026-59856 · Severity: info · CVSS 8.4 · Published 2026-07-09

Vim is a widely used open-source text editor. A vulnerability in its PHP auto-completion feature allows a specially crafted PHP file to execute malicious commands on a user's computer. If a user opens a malicious PHP file and triggers the 'omni-completion' feature (typically used for code suggestions), an attacker could gain full control over the user's system and data.

Technologies: Vim. Vendors: Vim.

Quick answers

Is CVE-2026-59856 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59856 being exploited in the wild.
How severe is CVE-2026-59856?: Informational severity, with a CVSS score of 8.4, published 9 July 2026.
Which products and versions are affected?: Vim < 9.2.0736.
Is there a fix for CVE-2026-59856?: A patch was published on 2026-07-09: Fixed in version 9.2.0736 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59856 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-59856?: Check whether you run Vim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability exists in the PHP omni-completion script (`runtime/autoload/phpcomplete.vim`) in Vim versions prior to 9.2.0736. The `phpcomplete#GetClassContentsStructure()` function interpolates class or trait names directly from the buffer into a `search()` pattern executed via `win_execute()` without proper escaping. By including a single quote and a pipe character (`|`) in a class name, an attacker can terminate the search string and execute arbitrary Ex commands. Exploitation requires the user to have filetype plugins enabled and to manually trigger omni-completion (CTRL-X CTRL-O) while editing a malicious PHP file. The issue is resolved in patch version 9.2.0736 by properly quoting the class name before interpolation.

Affected products

Vim Vim < 9.2.0736

Timeline

2026-06-28: advisory: GitHub Security Advisory published
2026-07-09: disclosed: CVE-2026-59856 published to NVD
2026-07-09: patched: Fixed in version 9.2.0736

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.