Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.
CVSS Details
- CVSS 4.0 Base Score: 8.4 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade vim-filesystemUpgrade vim-enhancedUpgrade vim-X11Upgrade vim-commonUpgrade vim-minimal | Aug 2, 2026 | Jul 29, 2026 |
| Alpine Linux | — | Upgrade vim | Jul 14, 2026 | Jul 9, 2026 |
| Amazon Linux Ami 2 | — | Upgrade vim-X11Upgrade vim-debuginfoUpgrade vim-filesystemUpgrade vim-commonUpgrade vim-dataUpgrade vim-minimalUpgrade vim-enhancedUpgrade xxd | Aug 5, 2026 | Aug 5, 2026 |
| Amazon_linux_2023 | — | Upgrade vim-debuginfoUpgrade vim-default-editorUpgrade vim-commonUpgrade vim-dataUpgrade vim-debugsourceUpgrade vim-minimalUpgrade vim-filesystemUpgrade vim-enhancedUpgrade xxdUpgrade vim-enhanced-debuginfoUpgrade xxd-debuginfoUpgrade vim-minimal-debuginfo | Aug 10, 2026 | Jul 9, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Aug 19, 2026 | Jul 9, 2026 |
| Redhat_linux | — | Upgrade vim-minimal-debuginfoNo solution existsUpgrade vim-X11-debuginfoUpgrade vim-enhancedUpgrade vim-debugsourceUpgrade vim-debuginfoUpgrade vim-X11Upgrade xxd-debuginfoUpgrade xxdUpgrade vim-enhanced-debuginfoUpgrade vim-dataUpgrade vim-common-debuginfoUpgrade vim-filesystemUpgrade vim-minimalUpgrade vim-common | Jul 17, 2026 | Jul 9, 2026 |
| Rocky_linux | — | Upgrade vim-common-debuginfoUpgrade vim-minimal-debuginfoUpgrade vim-minimalUpgrade vim-enhanced-debuginfoUpgrade vim-debugsourceUpgrade vim-X11-debuginfoUpgrade vim-commonUpgrade vim-enhancedUpgrade vim-X11Upgrade vim-debuginfo | Aug 3, 2026 | Aug 1, 2026 |
| Ubuntu | — | Upgrade vim (Ubuntu Pro)Upgrade vim-lesstif (Ubuntu Pro)Upgrade vim-motifUpgrade vimUpgrade vim-tinyUpgrade xxdUpgrade vim-athena-py2 (Ubuntu Pro)Upgrade xxd (Ubuntu Pro)Upgrade vim-gtk3Upgrade vim-runtime (Ubuntu Pro)Upgrade vim-nox-py2 (Ubuntu Pro)Upgrade vim-gtkUpgrade vim-common (Ubuntu Pro)Upgrade vim-gnome-py2 (Ubuntu Pro)Upgrade vim-athena (Ubuntu Pro)Upgrade vim-noxUpgrade vim-commonUpgrade vim-gtk3-py2 (Ubuntu Pro)Upgrade vim-gui-common (Ubuntu Pro)Upgrade vim-gtk (Ubuntu Pro)Upgrade vim-gui-commonUpgrade vim-athenaUpgrade vim-nox (Ubuntu Pro)Upgrade vim-gtk-py2 (Ubuntu Pro)Upgrade vim-gtk3 (Ubuntu Pro)Upgrade vim-tiny (Ubuntu Pro)Upgrade vim-runtimeUpgrade vim-gnome (Ubuntu Pro) | Jul 15, 2026 | Jul 14, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 13, 2026 | Jul 9, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub