CVE-2026-52858

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0561

Description The Python omni-completion script in python3complete.vim (for builds with the +python3 interpreter enabled) and pythoncomplete.vim (for builds with the +python interpreter) executes import and from statements found in the current buffer using Python's import machinery. Since the buffer's working directory is included in sys.path, opening a malicious .py file that has a sibling Python package and triggering omni-completion allows the top-level code of that package to be executed with the privileges of the user editing the file.

Recommendations Update to version 9.2.0561.