Loading story…
A high-severity vulnerability tracked as CVE-2026-59858 allows arbitrary code execution in Vim versions earlier than 9.2.0735 through the editor's C omni-completion feature. The flaw resides in runtime/autoload/ccomplete.vim, where unescaped tag data is inserted into a :vimgrep pattern and executed with :execute. An attacker can abuse a crafted tags entry so that, when a user opens a malicious .c file and triggers C omni-completion, injected Ex commands run with the privileges of the editing user.
Vim addressed the issue in patch 9.2.0735, which escapes the typename before constructing the :vimgrep command and blocks special characters such as / and | from breaking out of the pattern. The fix was committed in 6b611b0d15603c52ebdad17172b0232b4f65704e and includes regression tests to confirm that malicious typeref values no longer execute commands while normal struct-member completion continues to function.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE entry for the Vim arbitrary code execution issue was newly received by GitHub Security Advisories. The advisory describes the flaw as affecting Vim versions earlier than 9.2.0735 and notes that it was fixed in version 9.2.0735.
A Vim source-code commit fixed an Ex command injection flaw in runtime/autoload/ccomplete.vim by escaping the typename used to build a :vimgrep command. The patch also added regression tests and recorded the fix as patch 9.2.0735.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2026-59856** allows arbitrary code execution in Vim’s PHP omni-completion feature. In Vim versions prior to **9.2.0736**, the `runtime/autoload/phpcomplete.vim` script inserted a class or trait name from an edited PHP buffer into a `search()` pattern that was then executed through `win_execute()` without proper escaping. A crafted PHP file containing a malicious name with a quote and Ex command separator could break out of the intended pattern and trigger arbitrary Ex commands, including operating-system command execution via `:!`, when a user opened the file and invoked omni-completion.
Jul 10, 2026
Vim disclosed two medium-severity local code execution flaws in its Python omni-completion feature that can run attacker-controlled code when a user opens a malicious Python file and manually triggers completion, such as with `CTRL-X CTRL-O`. The first issue affects versions before `9.2.0561` and stems from the completer re-executing harvested `import` statements, which can load attacker-controlled sibling modules from the working directory in builds compiled with `+python3` or legacy `+python` and with filetype plugins enabled. Vim fixed that behavior in patch `9.2.0561` by disabling execution of harvested imports by default and allowing trusted users to re-enable it with `g:pythoncomplete_allow_import = 1`. A second flaw, later assigned **CVE-2026-52860**, affects versions before `9.2.0597` and bypasses that earlier mitigation because Vim reconstructs Python function and class definitions from the current buffer and executes them with `exec()`. That allows attacker-controlled default values, annotations, and class base expressions to run inside the user's Vim process when omni-completion is invoked, including by plugins that call the completion function. Vim said the issue does not affect builds without Python support and released patch `9.2.0597`; the disclosures credit **tonghuaroot** for the earlier bug and **DavidCarliez** for reporting and analyzing the later `exec()`-based issue.
Jun 29, 2026Vim disclosed a medium-severity code injection flaw in its Cucumber filetype plugin that affects versions earlier than `9.2.0496` when compiled with `+ruby` support. The bug is in `s:stepmatch()` in `runtime/ftplugin/cucumber.vim`, where attacker-controlled step-definition regex patterns from repository `.rb` files were inserted into Ruby `Kernel.eval()` without sufficient escaping, allowing arbitrary Ruby execution and potentially shell command execution. The issue is tracked in GitHub Security Advisory `GHSA-4473-94jm-w5x9` and mapped to `CWE-94` and `CWE-95`. Exploitation requires a user to open a malicious cucumber-style repository and trigger the step-jump mappings `[`d`]` or `]d` on a matching feature line; the vulnerability does **not** fire through omni-completion alone because `CucumberComplete()` does not call the vulnerable path. Vim fixed the bug in patch `9.2.0496` by replacing `Kernel.eval()` with `Regexp.new()`, keeping the regex as untrusted data rather than executable code, and added a regression test using a proof-of-concept payload that attempted to invoke `system("touch ...")`. The project credited Aisle Research for reporting and analyzing the flaw.
Jun 29, 2026