CVE-2026-52858

A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a sibling Python package. This could lead to a complete compromise of the user's system.

This is an Important vulnerability in Vim that allows a local attacker to achieve arbitrary code execution. The flaw occurs when a user opens a specially crafted Python file and invokes omni-completion, leading to the execution of malicious code from a co-located Python package. This risk is present in Red Hat Enterprise Linux and other products where Vim is deployed with Python omni-completion enabled, potentially compromising the editing user's system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Users can mitigate this vulnerability by disabling Python omni-completion in Vim if it is not essential for their workflow. This prevents the execution of untrusted Python code when opening hostile files. To disable this feature, ensure that the omnifunc option in your Vim configuration (e.g., ~/.vimrc) is not set to pythoncomplete#Complete or python3complete#Complete. Alternatively, users should avoid invoking omni-completion (Ctrl-X Ctrl-O) on Python files from untrusted sources. Disabling Python omni-completion may affect Python development functionality within Vim.