Critical Vulnerability in Vim: Python Omni-Completion Execution Flaw
Summary
ALPINE-CVE-2026-52860: Vim is an open source, command line text editor. Affects vim versions < 9.2.0602-r0. Fixed in 9.2.0602-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a widely used open-source command line text editor known for its efficiency and extensibility. It supports various programming languages, including Python, allowing users to leverage powerful features like omni-completion for coding assistance. However, prior to version 9.2.0597, Vim's implementation of Python omni-completion posed a significant security risk, enabling the execution of arbitrary Python code from the current buffer.
Vulnerability Detail
The vulnerability arises from Vim's Python omni-completion feature, which executes reconstructed function and class definitions using exec() to populate the completion dictionary. This behavior allows a malicious user to craft a hostile buffer that can execute attacker-controlled Python expressions during the completion process. The existing mitigation, g:pythoncomplete_allow_import, does not address this issue, as it does not cover execution paths that involve non-import statements. As a result, this vulnerability can lead to unauthorized code execution, potentially compromising the integrity and security of the user's environment.
How To Fix
Minimum fixed version
9.2.0602-r0
This is the first release that contains the fix.
sudo apk add --upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the Python omni-completion feature by setting the following in their Vim configuration: 'let g:pythoncomplete = 0'. This will prevent the execution of potentially harmful code until the package can be updated.
Conclusion
In summary, the vulnerability in Vim's Python omni-completion feature poses a significant security risk by allowing the execution of arbitrary code. Users are strongly advised to update to the patched version 9.2.0602-r0 or later to mitigate this risk. Until an update can be applied, disabling the feature serves as a temporary workaround.
See every vulnerability recorded for vim →
FAQ
The vulnerability allows for the execution of arbitrary Python code through the omni-completion feature, which can be exploited by a hostile buffer.
You can check your version of Vim by running 'vim --version' in the terminal. If it is below 9.2.0602-r0, it is vulnerable.
Exploitation of this vulnerability can lead to unauthorized code execution, compromising the security of the user's system.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can also check your application for this specific vulnerability using the Vulert playground.
If an immediate update is not possible, implement the workaround by disabling Python omni-completion in your Vim configuration to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for vim.
