CVE-2026-52858

HIGH EPSS 10.1%
Published Jun 11, 20262w ago · Modified Jun 17, 20262w ago
7.3 CVSS 4.0
High
Find Similar
Published Jun 11, 2026 2w ago
Last Modified Jun 17, 2026 2w ago

Description

Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package's top-level code as the editing user. This issue has been patched in version 9.2.0561.

CVSS Details

Base Score
7.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction A
Scope X

Threat Intelligence

EPSS Exploit Probability
10.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 3

CWE-829
CWE-94 Improper Control of Generation of Code (Code Injection) Injection
CWE-95

Affected Products 1

VendorProductVersionRange
vimvim* <9.2.0561

References 3

  • github.com https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d
    Patch
  • github.com https://github.com/vim/vim/releases/tag/v9.2.0561
    Product
  • github.com https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c
    MitigationVendor Advisory

Remediation

  • github.com https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d
    Patch