CVE-2026-57456

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0699

Description Python omni-completion in the text editor executes reconstructed function and class definitions from the current buffer using the exec() function to populate the completion dictionary. Because docstrings are inserted verbatim between triple quotes without escaping, a specially crafted buffer can break out of the literal string to execute arbitrary Python code. This occurs within the runtime/autoload/python3complete.vim and pythoncomplete.vim scripts. An attacker can trigger this by inducing a user to open or paste a malicious file and then initiate omni-completion, leading to arbitrary code execution under the user's privileges.

Recommendations Update to version 9.2.0699.