PT-2026-48723 · Vim+2 · Vim+2

Tonghuaroot · CVE-2026-52860 · Published 2026-06-11 · Updated 2026-07-16

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0597

Description Python omni-completion in the text editor executes reconstructed function and class definitions from the current buffer using the exec() function to populate the completion dictionary. Because Python evaluates class base expressions, parameter annotations, and function default values during definition, a malicious buffer can trigger the execution of attacker-controlled Python expressions during the omni-completion process. The g:pythoncomplete allow import mitigation is ineffective in this case as the executed code is not an import statement.

Recommendations Update to version 9.2.0597.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-52860

ECHO-1AE5-1AA8-8736

GHSA-52MC-RQ6P-RC7C

GHSA-65P9-MWWX-7468

OESA-2026-2863

USN-8451-1

Affected Products

Linuxmint

Ubuntu

Vim

References · 34

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52860.json · Exploit
• https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c · Vendor Advisory
• https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468 · Vendor Advisory
• https://github.com/vim/vim/commit/c8c63673bc4253212820626aeeb75999d9a539d2 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-52860 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-52860 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-52860 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-52860 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2026-52860 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8451-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-47167 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-52860 · Security Note
• https://ubuntu.com/security/CVE-2026-52858 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-52859 · Security Note
• https://ubuntu.com/security/CVE-2026-52860 · Vendor Advisory