PT-2026-48721 · Vim+2 · Vim+2

Tonghuaroot · CVE-2026-52858 · Published 2026-06-11 · Updated 2026-07-16

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0561

Description The Python omni-completion script in python3complete.vim (for builds with the +python3 interpreter enabled) and pythoncomplete.vim (for builds with the +python interpreter) executes import and from statements found in the current buffer using Python's import machinery. Since the buffer's working directory is included in sys.path, opening a malicious .py file that has a sibling Python package and triggering omni-completion allows the top-level code of that package to be executed with the privileges of the user editing the file.

Recommendations Update to version 9.2.0561.

Exploit

Fix

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

CWE-829

Related Identifiers

CVE-2026-52858

ECHO-C2A9-CB6F-D4B0

GHSA-52MC-RQ6P-RC7C

OESA-2026-2863

USN-8451-1

Affected Products

Linuxmint

Ubuntu

Vim

References · 33

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52858.json · Exploit
• https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d · Patch
• https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-38510.html · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-52858 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8451-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-52858 · Security Note
• https://osv.dev/vulnerability/CVE-2026-52858 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-52858 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-52858 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-52860 · Security Note
• https://ubuntu.com/security/CVE-2026-52858 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-52859 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-47167 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-52860 · Vendor Advisory