Arbitrary Code Execution in Vim Python Omni-Completion

CVE-2026-52860 is an arbitrary code execution vulnerability in Vim affecting versions prior to 9.2.0597. The flaw is in Vim's Python omni-completion implementation, including runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim path, where source code reconstructed from the current Python buffer is executed with exec() to populate the completion dictionary. The reconstructed source includes function and class definitions derived from buffer contents; parameter lists, default expressions, annotations, and class base lists are preserved from attacker-controlled text harvested by internal parsing logic such as _parenparse(). Because Python evaluates function default values, parameter annotations, and class base expressions at definition time, a malicious Python buffer can cause attacker-controlled expressions to execute when omni-completion is triggered. The previously documented g:pythoncomplete_allow_import mitigation does not prevent this path because the executed content is not limited to harvested import/from statements.