Skip to content
OpenAdvisories
High · 8.4 CVE-2026-57456 EUVD-2026-39436

Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings

Published Jun 25, 2026 · Updated Jun 26, 2026 · Assigned by GitHub_M

Vendor: vim Product: vim Package: vim Package: vim Package: vim Package: vim Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. When reconstructing that source, each scope's docstring is inserted verbatim between triple quotes with no escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled Python during omni-completion. This vulnerability is fixed in 9.2.0699.

Affected products

VendorProductAffectedFixed
vim vim < 9.2.0699 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 vim 2:9.2.0782-1 —
Debian 13 vim 2:9.1.1230-2+deb13u1 —
Debian 12 vim No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS vim 2:9.1.2141-1ubuntu4.6 USN-8500-1
Ubuntu 25.10 vim 2:9.1.0967-1ubuntu6.8 USN-8500-1
Ubuntu 24.04 LTS vim 2:9.1.0016-1ubuntu7.17 USN-8500-1
Ubuntu 22.04 LTS vim 2:8.2.3995-1ubuntu2.33 USN-8500-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS vim 2:8.1.2269-1ubuntu5.32+esm9 USN-8500-1
Ubuntu Pro 18.04 LTS vim 2:8.0.1453-1ubuntu1.13+esm21 USN-8500-1
Ubuntu Pro 16.04 LTS vim 2:7.4.1689-3ubuntu1.5+esm36 USN-8500-1
Ubuntu Pro 14.04 LTS vim 2:7.4.052-1ubuntu3.1+esm30 USN-8500-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 vim +3 2:9.1.083-9.el10_2.12 RHSA-2026:48650
RHEL 9 vim +3 2:8.2.2637-26.el9_8.13 RHSA-2026:47982
RHEL 8 vim +3 2:8.0.1763-31.el8_10 RHSA-2026:48703
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS vim +3 2:9.1.083-5.el10_0.4 RHSA-2026:55431
RHEL 9.6 EUS vim +5 2:8.2.2637-22.el9_6.4 RHSA-2026:70818
RHEL 9.4 E4S vim +5 2:8.2.2637-20.el9_4.4 RHSA-2026:72465
RHEL 9.2 E4S vim +5 2:8.2.2637-20.el9_2.3 RHSA-2026:72466
RHEL 7 ELS vim +4 2:7.4.629-8.el7_9.2 RHSA-2026:68711
RHEL 6 ELS vim +4 2:7.4.629-5.el6_10.4 RHSA-2026:69128
Red Hat Hardened Images 1 vim +8 2:9.2.780-1.hum1 RHSA-2026:35387

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 xxd +6 2:9.1.083-9.el10_2.12 ALSA-2026:48650
AlmaLinux 9 vim-X11 +4 2:8.2.2637-26.el9_8.13 ALSA-2026:47982
AlmaLinux 8 vim-X11 +4 2:8.0.1763-31.el8_10 ALSA-2026:48703

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 vim 2:9.1.083-9.el10_2.12 RLSA-2026:48650
Rocky Linux 9 vim 2:8.2.2637-26.el9_8.13 RLSA-2026:47982
Rocky Linux 8 vim 2:8.0.1763-31.el8_10 RLSA-2026:48703

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 vim 9.2.0699-r0 —
Alpine v3.23 vim 9.2.0854-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 xxd +6 2:9.2.725-1.amzn2023.0.1 ALAS2023-2026-1940
Amazon Linux 2 xxd +6 2:9.0.2153-1.amzn2.0.8 ALAS2-2026-3804

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 vim 9.2.0735-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 xxd +6 2:9.1.083-9.0.1.el10_2.12 ELSA-2026-48650
Oracle Linux 9 vim-X11 +4 2:8.2.2637-26.0.1.el9_8.13 ELSA-2026-47982
Oracle Linux 8 vim-X11 +4 2:8.0.1763-31.0.1.el8_10 ELSA-2026-48703

Advisories 24

References