CVE-2026-52860

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0597

Description Python omni-completion in the text editor executes reconstructed function and class definitions from the current buffer using the exec() function to populate the completion dictionary. Because Python evaluates class base expressions, parameter annotations, and function default values during definition, a malicious buffer can trigger the execution of attacker-controlled Python expressions during the omni-completion process. The g:pythoncomplete allow import mitigation is ineffective in this case as the executed code is not an import statement.

Recommendations Update to version 9.2.0597.