Skip to content
OpenAdvisories
High · 8.4 CVE-2026-59856 EUVD-2026-42753

Vim: Arbitrary Code Execution via PHP Omni-Completion

Published Jul 9, 2026 · Updated Jul 14, 2026 · Assigned by GitHub_M

Vendor: vim Product: vim Package: vim Package: vim Package: vim Package: vim Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.

Affected products

VendorProductAffectedFixed
vim vim < 9.2.0736 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 vim 2:9.2.0782-1 —
Debian 13 vim 2:9.1.1230-2+deb13u1 —
Debian 12 vim No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS vim 2:9.1.2141-1ubuntu4.7 USN-8541-1
Ubuntu 24.04 LTS vim 2:9.1.0016-1ubuntu7.18 USN-8541-1
Ubuntu 22.04 LTS vim 2:8.2.3995-1ubuntu2.34 USN-8541-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS vim 2:8.1.2269-1ubuntu5.32+esm10 USN-8541-1
Ubuntu Pro 18.04 LTS vim 2:8.0.1453-1ubuntu1.13+esm22 USN-8541-1
Ubuntu Pro 16.04 LTS vim 2:7.4.1689-3ubuntu1.5+esm37 USN-8541-1
Ubuntu Pro 14.04 LTS vim 2:7.4.052-1ubuntu3.1+esm31 USN-8541-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 vim +3 2:9.1.083-9.el10_2.12 RHSA-2026:48650
RHEL 9 vim +3 2:8.2.2637-26.el9_8.13 RHSA-2026:47982
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS vim +3 2:9.1.083-5.el10_0.4 RHSA-2026:55431
RHEL 9.6 EUS vim +5 2:8.2.2637-22.el9_6.4 RHSA-2026:70818
RHEL 9.4 E4S vim +5 2:8.2.2637-20.el9_4.4 RHSA-2026:72465
RHEL 9.2 E4S vim +5 2:8.2.2637-20.el9_2.3 RHSA-2026:72466
Red Hat Hardened Images 1 vim +8 2:9.2.780-1.hum1 RHSA-2026:35387

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 xxd +6 2:9.1.083-9.el10_2.12 ALSA-2026:48650
AlmaLinux 9 vim-X11 +4 2:8.2.2637-26.el9_8.13 ALSA-2026:47982

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 vim 2:9.1.083-9.el10_2.12 RLSA-2026:48650
Rocky Linux 9 vim 2:8.2.2637-26.el9_8.13 RLSA-2026:47982

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 vim 9.2.0780-150500.20.61.2 SUSE-SU-2026:3458-1
SLES 15 SP6 vim 9.2.0780-150500.20.61.2 SUSE-SU-2026:3458-1
SLES 15 SP5 vim 9.2.0780-150500.20.61.2 SUSE-SU-2026:3458-1
SLES 15 SP4 vim 9.2.0780-150000.5.99.1 SUSE-SU-2026:3271-1
SLES 12 SP5 vim 9.2.0780-17.73.1 SUSE-SU-2026:3237-1
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 vim 9.2.0780-160000.1.1 SUSE-SU-2026:22821-1
SLES for SAP 15 SP6 vim 9.2.0780-150500.20.61.2 SUSE-SU-2026:3458-1
SLES for SAP 15 SP5 vim 9.2.0780-150500.20.61.2 SUSE-SU-2026:3458-1
SLES for SAP 15 SP4 vim 9.2.0780-150000.5.99.1 SUSE-SU-2026:3271-1
SLES 16.0 vim 9.2.0780-160000.1.1 SUSE-SU-2026:22821-1
SLE Micro 6.2 vim 9.2.0780-160000.1.1 SUSE-SU-2026:22754-1, SUSE-SU-2026:22740-1
SLE Micro 6.1 vim 9.2.0780-slfo.1.1_1.1 SUSE-SU-2026:22901-1
SLE Micro 6.0 vim 9.2.0780-1.1 SUSE-SU-2026:22797-1
SLE Micro 5.5 vim 9.2.0780-150500.20.61.2 SUSE-SU-2026:3458-1
SLE Micro 5.4 vim 9.2.0780-150000.5.99.1 SUSE-SU-2026:3271-1
SLE Micro 5.3 vim 9.2.0780-150000.5.99.1 SUSE-SU-2026:3271-1
SLE HPC 15 SP5 vim 9.2.0780-150500.20.61.2 SUSE-SU-2026:3458-1
SLE HPC 15 SP4 vim 9.2.0780-150000.5.99.1 SUSE-SU-2026:3271-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 vim 9.2.0780-160000.1.1 openSUSE-SU-2026:21374-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 vim 9.2.0747-r0 —
Alpine v3.23 vim 9.2.0854-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 xxd +6 2:9.2.780-1.amzn2023.0.1 ALAS2023-2026-1993
Amazon Linux 2 xxd +6 2:9.0.2153-1.amzn2.0.9 ALAS2-2026-3829

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 vim 9.2.0782-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 xxd +6 2:9.1.083-9.0.1.el10_2.12 ELSA-2026-48650
Oracle Linux 9 vim-X11 +4 2:8.2.2637-26.0.1.el9_8.13 ELSA-2026-47982

Advisories 26

References