Vulnerability · Published Jun 25, 2026 · Assigned by GitHub_M
CVE-2026-57456Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings
High 8.4
In plain English
A high-severity code injection in vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. When reconstructing that source, each scope's docstring is inserted verbatim between triple quotes with no escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled Python during omni-completion. This vulnerability is fixed in 9.2.0699.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | vim-X11 | 2:9.1.083-9.el10_2.12 | ALSA-2026:48650 |
| AlmaLinux:8 | vim-X11 | 2:8.0.1763-31.el8_10 | ALSA-2026:48703 |
| AlmaLinux:9 | vim-X11 | 2:8.2.2637-26.el9_8.13 | ALSA-2026:47982 |
| AlmaLinux:10 | vim-common | 2:9.1.083-9.el10_2.12 | ALSA-2026:48650 |
| AlmaLinux:8 | vim-common | 2:8.0.1763-31.el8_10 | ALSA-2026:48703 |
| AlmaLinux:9 | vim-common | 2:8.2.2637-26.el9_8.13 | ALSA-2026:47982 |
| AlmaLinux:10 | vim-data | 2:9.1.083-9.el10_2.12 | ALSA-2026:48650 |
| AlmaLinux:10 | vim-enhanced | 2:9.1.083-9.el10_2.12 | ALSA-2026:48650 |
| AlmaLinux:8 | vim-enhanced | 2:8.0.1763-31.el8_10 | ALSA-2026:48703 |
| AlmaLinux:9 | vim-enhanced | 2:8.2.2637-26.el9_8.13 | ALSA-2026:47982 |
| AlmaLinux:10 | vim-filesystem | 2:9.1.083-9.el10_2.12 | ALSA-2026:48650 |
| AlmaLinux:8 | vim-filesystem | 2:8.0.1763-31.el8_10 | ALSA-2026:48703 |
| AlmaLinux:9 | vim-filesystem | 2:8.2.2637-26.el9_8.13 | ALSA-2026:47982 |
| AlmaLinux:10 | vim-minimal | 2:9.1.083-9.el10_2.12 | ALSA-2026:48650 |
| AlmaLinux:8 | vim-minimal | 2:8.0.1763-31.el8_10 | ALSA-2026:48703 |
| AlmaLinux:9 | vim-minimal | 2:8.2.2637-26.el9_8.13 | ALSA-2026:47982 |
| AlmaLinux:10 | xxd | 2:9.1.083-9.el10_2.12 | ALSA-2026:48650 |
| Alpine:v3.23 | vim | 9.2.0854-r0 | ALPINE-CVE-2026-57456 |
| Alpine:v3.24 | vim | 9.2.0699-r0 | ALPINE-CVE-2026-57456 |
| Debian:12 | vim | no fix listed | DEBIAN-CVE-2026-57456 |
| Debian:13 | vim | 2:9.1.1230-2+deb13u1 | DEBIAN-CVE-2026-57456 |
| Debian:14 | vim | 2:9.2.0782-1 | DEBIAN-CVE-2026-57456 |
| Rocky Linux:10 | vim | 2:9.1.083-9.el10_2.12 | RLSA-2026:48650 |
| Rocky Linux:8 | vim | 2:8.0.1763-31.el8_10 | RLSA-2026:48703 |
| Rocky Linux:9 | vim | 2:8.2.2637-26.el9_8.13 | RLSA-2026:47982 |
| Ubuntu:22.04:LTS | vim | 2:8.2.3995-1ubuntu2.33 | USN-8500-1 |
| Ubuntu:22.04:LTS | vim | 2:8.2.3995-1ubuntu2.33 | UBUNTU-CVE-2026-57456 |
| Ubuntu:24.04:LTS | vim | 2:9.1.0016-1ubuntu7.17 | USN-8500-1 |
| Ubuntu:24.04:LTS | vim | 2:9.1.0016-1ubuntu7.17 | UBUNTU-CVE-2026-57456 |
| Ubuntu:25.10 | vim | 2:9.1.0967-1ubuntu6.8 | UBUNTU-CVE-2026-57456 |
| Ubuntu:25.10 | vim | 2:9.1.0967-1ubuntu6.8 | USN-8500-1 |
| Ubuntu:26.04:LTS | vim | 2:9.1.2141-1ubuntu4.6 | USN-8500-1 |
| Ubuntu:26.04:LTS | vim | 2:9.1.2141-1ubuntu4.6 | UBUNTU-CVE-2026-57456 |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3 x_refsource_CONFIRM
- https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8 x_refsource_MISC
- https://github.com/vim/vim/releases/tag/v9.2.0699 x_refsource_MISC