CVE-2026-52858
Vim is an open source, command line text editor
Published: 2026-06-11 · Last updated: 2026-06-11
Severity and scoring
- CWE
- CWE-829, CWE-94, CWE-95
Description
Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package's top-level code as the editing user. This issue has been patched in version 9.2.0561.
Source: NVD
References
Related CVEs
Same CWE
- CVE-2026-53810 — OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redirect loading towar... (8.8 HIGH)
- CVE-2026-52860 — Vim is an open source, command line text editor
- CVE-2026-47174 — In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build workflow completes
- CVE-2026-47172 — Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support
- CVE-2026-47167 — Vim is an open source, command line text editor