CVE-2026-57456: Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings
Last updated 2 July 2026
Other sources
Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. When reconstructing that source, each scope's docstring is inserted verbatim between triple quotes with no escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled Python during omni-completion. This vulnerability is fixed in 9.2.0699.
— NVD
Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.0735-1 - Upgrade
Upgrade
Vim (Python omni-completion)to a version that resolves this vulnerability.Fixed in 9.2.0699
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57456?
CVE-2026-57456 has a high severity score of 8.4 based on the CVSS v4.0 metrics.
How does CVE-2026-57456 allow arbitrary code execution?
CVE-2026-57456 allows arbitrary code execution through Python omni-completion that executes function and class definitions with exec() from the current buffer.
Which versions of Vim are affected by CVE-2026-57456?
CVE-2026-57456 affects all versions of Vim prior to 9.2.0699.
How do I fix CVE-2026-57456?
To fix CVE-2026-57456, upgrade Vim to version 9.2.0699 or later.
What types of applications are at risk due to CVE-2026-57456?
Applications that utilize Vim for editing and support Python omni-completion are at risk due to CVE-2026-57456.