Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package's top-level code as the editing user. This issue has been patched in version 9.2.0561.
CVSS Details
- CVSS 4.0 Base Score: 7.3 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade vim | Jun 18, 2026 | Jun 11, 2026 |
| Amazon Linux Ami 2 | — | Upgrade vim-minimalUpgrade vim-commonUpgrade vim-X11Upgrade xxdUpgrade vim-filesystemUpgrade vim-enhancedUpgrade vim-debuginfoUpgrade vim-data | Jun 23, 2026 | Jun 23, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Aug 19, 2026 | Jun 11, 2026 |
| Redhat_linux | — | Upgrade vim-enhanced-debuginfoUpgrade vim-minimalUpgrade vim-dataUpgrade vim-commonUpgrade vim-common-debuginfoUpgrade vim-minimal-debuginfoUpgrade xxdUpgrade vim-debugsourceUpgrade vim-filesystemUpgrade vim-debuginfoUpgrade xxd-debuginfoUpgrade vim-enhancedUpgrade vim-X11-debuginfoUpgrade vim-X11 | Aug 5, 2026 | Jun 11, 2026 |
| Rocky_linux | — | Upgrade vim-minimalUpgrade vim-enhanced-debuginfoUpgrade vim-debugsourceUpgrade vim-common-debuginfoUpgrade vim-enhancedUpgrade vim-X11-debuginfoUpgrade vim-minimal-debuginfoUpgrade vim-debuginfoUpgrade vim-X11Upgrade vim-common | Aug 13, 2026 | Aug 11, 2026 |
| Ubuntu | — | Upgrade vim-common (Ubuntu Pro)Upgrade vim-gui-commonUpgrade vim-gnome (Ubuntu Pro)Upgrade vim-gnome-py2 (Ubuntu Pro)Upgrade vim-noxUpgrade vim-tiny (Ubuntu Pro)Upgrade vim-gtk (Ubuntu Pro)Upgrade vim-athenaUpgrade vim-nox (Ubuntu Pro)Upgrade vim-gtk3-py2 (Ubuntu Pro)Upgrade vim-gtk3 (Ubuntu Pro)Upgrade vim-commonUpgrade vim-gtk-py2 (Ubuntu Pro)Upgrade vim-gtk3Upgrade vimUpgrade vim-lesstif (Ubuntu Pro)Upgrade xxd (Ubuntu Pro)Upgrade vim (Ubuntu Pro)Upgrade vim-gtkUpgrade vim-athena (Ubuntu Pro)Upgrade vim-motifUpgrade vim-athena-py2 (Ubuntu Pro)Upgrade vim-tinyUpgrade vim-runtime (Ubuntu Pro)Upgrade vim-runtimeUpgrade vim-nox-py2 (Ubuntu Pro)Upgrade xxdUpgrade vim-gui-common (Ubuntu Pro) | Jun 21, 2026 | Jun 18, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 1, 2026 | Jun 11, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub