CVE catalog

CVE-2026-52860

Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as pa

[CVE catalog]

Severity
High · CVSS 8CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.22% · Oct 25, 2026

Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluates function default values, parameter annotations, and class base expressions at definition time, so a hostile buffer can execute attacker-controlled Python expressions during omni-completion. The existing g:pythoncomplete_allow_import mitigation (GHSA-52mc-rq6p-rc7c) does not cover this path, because the attacker-controlled code is not a harvested import/from statement. This issue has been patched in version 9.2.0597.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianvimsid2:9.2.0858-1fixed
Debianvimforky2:9.2.0858-1fixed
Debianvimtrixie2:9.1.1230-2vulnerable
Debianvimbookworm2:9.0.1378-2+deb12u2vulnerable
CpevimNot reported2:9.1.0016-1ubuntu7.16fixed
Cpevim-athenaNot reported2:9.1.0016-1ubuntu7.16fixed
Cpevim-commonNot reported2:9.1.0016-1ubuntu7.16fixed
Cpevim-docNot reported2:9.1.0016-1ubuntu7.16fixed
Cpevim-gtk3Not reported2:9.1.0016-1ubuntu7.16fixed
Cpevim-gui-commonNot reported2:9.1.0016-1ubuntu7.16fixed
Cpevim-motifNot reported2:9.1.0016-1ubuntu7.16fixed
Cpevim-noxNot reported2:9.1.0016-1ubuntu7.16fixed
Cpevim-runtimeNot reported2:9.1.0016-1ubuntu7.16fixed
Cpevim-tinyNot reported2:9.1.0016-1ubuntu7.16fixed
CpexxdNot reported2:9.1.0016-1ubuntu7.16fixed
CpevimNot reportedNot reportedvulnerable
CpevimNot reported9.2.0597fixed
CpevimNot reported9.2.0597fixed
Alpinevim3.239.2.0602-r0fixed
Ubuntuvimpro2:8.1.0875-5ubuntu2vulnerable
Ubuntuvimpro2:8.1.0875-5ubuntu3vulnerable
Ubuntuvimpro2:8.1.0875-5ubuntu4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu1vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.3vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.6vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.7vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.8vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.9vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.11vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.12vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.13vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.14vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.15vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.16vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.17vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.18vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.20vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.21vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.22vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.23vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.24vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.25vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.26vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.29vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.30vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.31vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm2vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm3vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm5vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm6vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm7vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm8fixed
Ubuntuvim22.042:8.2.2434-3ubuntu3vulnerable
Ubuntuvim22.042:8.2.2434-3ubuntu4vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu1vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu2vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu3vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu5vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu1vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.1vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.3vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.4vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.5vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.7vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.8vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.9vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.10vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.11vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.12vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.13vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.15vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.16vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.17vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.18vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.19vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.20vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.21vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.22vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.23vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.24vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.26vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.27vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.28vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.29vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.30vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.31vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.32fixed
Ubuntuvim24.042:9.0.1672-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2087-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2184-0ubuntu1vulnerable
Ubuntuvim24.042:9.0.2189-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.3vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.4vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.5vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.8vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.9vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.10vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.11vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.12vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.13vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.14vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.15vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.16fixed
Ubuntuvim25.102:9.1.0967-1ubuntu4vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu5vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.1vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.2vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.3vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.4vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.5vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.6vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.7fixed
Ubuntuvim26.042:9.1.0967-1ubuntu6vulnerable
Ubuntuvim26.042:9.1.1882-1ubuntu1vulnerable
Ubuntuvim26.042:9.1.1882-1ubuntu2vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu1vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu2vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4.1vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4.2vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4.3vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4.5fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianvimsourcesid2:9.2.0782-1not yet assignedNot reported[1139730]
Debianvimsourceforky2:9.2.0782-1not yet assignedNot reported[1139730]
Debianvimsourcetrixie(unfixed)not yet assignedNot reported[1139730]
Debianvimsourcebookworm(unfixed)not yet assignedNot reported[1139730]
CpevimcpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
Cpevim-athenacpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
Cpevim-commoncpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
Cpevim-doccpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
Cpevim-gtk3cpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
Cpevim-gui-commoncpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
Cpevim-motifcpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
Cpevim-noxcpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
Cpevim-runtimecpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
Cpevim-tinycpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
CpexxdcpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
CpevimcpeNot reported9.2.0597Not reportedNot reportedNot reported
CpevimcpeNot reported9.2.0597Not reportedNVD-CVE-2026-52860Not reported
Alpinevimapk3.239.2.0602-r0Not reportedALPINE-CVE-2026-52860Not reported
Ubuntuvimdebpro2:8.1.2269-1ubuntu5.32+esm8Not reportedUBUNTU-CVE-2026-52860Not reported
Ubuntuvimdeb22.042:8.2.3995-1ubuntu2.32Not reportedUBUNTU-CVE-2026-52860Not reported
Ubuntuvimdeb24.042:9.1.0016-1ubuntu7.16Not reportedUBUNTU-CVE-2026-52860Not reported
Ubuntuvimdeb25.102:9.1.0967-1ubuntu6.7Not reportedUBUNTU-CVE-2026-52860Not reported
Ubuntuvimdeb26.042:9.1.2141-1ubuntu4.5Not reportedUBUNTU-CVE-2026-52860Not reported

[Debian bug #1139730]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [vim]Affected
    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-athena]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-doc]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-gtk3]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-gui-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-motif]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-nox]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-runtime]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-tiny]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [xxd]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

[Debian 13 (Trixie)]

  • [vim]Affected
    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-athena]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-doc]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-gtk3]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-gui-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-motif]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-nox]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-runtime]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]