Loading story…
A high-severity vulnerability tracked as CVE-2026-59856 allows arbitrary code execution in Vim’s PHP omni-completion feature. In Vim versions prior to 9.2.0736, the runtime/autoload/phpcomplete.vim script inserted a class or trait name from an edited PHP buffer into a search() pattern that was then executed through win_execute() without proper escaping. A crafted PHP file containing a malicious name with a quote and Ex command separator could break out of the intended pattern and trigger arbitrary Ex commands, including operating-system command execution via :!, when a user opened the file and invoked omni-completion.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-59856 was published as a high-severity arbitrary code execution vulnerability affecting Vim versions prior to 9.2.0736 in the PHP omni-completion feature. The disclosure states that a crafted PHP file can trigger arbitrary OS command execution when a victim opens the file and invokes omni-completion.
A Vim source-code commit fixed a command-injection flaw in runtime/autoload/phpcomplete.vim by wrapping the search pattern with string() before passing it to win_execute(). The patch also added a regression test and updated Vim's included_patches list to patch 9.2.0736.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2026-59858** allows arbitrary code execution in **Vim** versions earlier than `9.2.0735` through the editor's C omni-completion feature. The flaw resides in `runtime/autoload/ccomplete.vim`, where unescaped tag data is inserted into a `:vimgrep` pattern and executed with `:execute`. An attacker can abuse a crafted `tags` entry so that, when a user opens a malicious `.c` file and triggers C omni-completion, injected **Ex commands** run with the privileges of the editing user. Vim addressed the issue in patch **9.2.0735**, which escapes the typename before constructing the `:vimgrep` command and blocks special characters such as `/` and `|` from breaking out of the pattern. The fix was committed in `6b611b0d15603c52ebdad17172b0232b4f65704e` and includes regression tests to confirm that malicious `typeref` values no longer execute commands while normal struct-member completion continues to function.
Jul 10, 2026
Vim disclosed two medium-severity local code execution flaws in its Python omni-completion feature that can run attacker-controlled code when a user opens a malicious Python file and manually triggers completion, such as with `CTRL-X CTRL-O`. The first issue affects versions before `9.2.0561` and stems from the completer re-executing harvested `import` statements, which can load attacker-controlled sibling modules from the working directory in builds compiled with `+python3` or legacy `+python` and with filetype plugins enabled. Vim fixed that behavior in patch `9.2.0561` by disabling execution of harvested imports by default and allowing trusted users to re-enable it with `g:pythoncomplete_allow_import = 1`. A second flaw, later assigned **CVE-2026-52860**, affects versions before `9.2.0597` and bypasses that earlier mitigation because Vim reconstructs Python function and class definitions from the current buffer and executes them with `exec()`. That allows attacker-controlled default values, annotations, and class base expressions to run inside the user's Vim process when omni-completion is invoked, including by plugins that call the completion function. Vim said the issue does not affect builds without Python support and released patch `9.2.0597`; the disclosures credit **tonghuaroot** for the earlier bug and **DavidCarliez** for reporting and analyzing the later `exec()`-based issue.
Jun 29, 2026Vim disclosed a medium-severity code injection flaw in its Cucumber filetype plugin that affects versions earlier than `9.2.0496` when compiled with `+ruby` support. The bug is in `s:stepmatch()` in `runtime/ftplugin/cucumber.vim`, where attacker-controlled step-definition regex patterns from repository `.rb` files were inserted into Ruby `Kernel.eval()` without sufficient escaping, allowing arbitrary Ruby execution and potentially shell command execution. The issue is tracked in GitHub Security Advisory `GHSA-4473-94jm-w5x9` and mapped to `CWE-94` and `CWE-95`. Exploitation requires a user to open a malicious cucumber-style repository and trigger the step-jump mappings `[`d`]` or `]d` on a matching feature line; the vulnerability does **not** fire through omni-completion alone because `CucumberComplete()` does not call the vulnerable path. Vim fixed the bug in patch `9.2.0496` by replacing `Kernel.eval()` with `Regexp.new()`, keeping the regex as untrusted data rather than executable code, and added a regression test using a proof-of-concept payload that attempted to invoke `system("touch ...")`. The project credited Aisle Research for reporting and analyzing the flaw.
Jun 29, 2026