https://seclists.org/oss-sec/2026/q3/576: [vim-security] Arbitrary Ex Command Execution via File Names in C Omni-Completion in Vim < 9.2.1011

Q: What conditions are required for exploitation?

The user must invoke C omni-completion for a member access, and Vim must receive a tags file name from tagfiles() that contains a bar character. The bar terminates the constructed :vimgrep command, allowing subsequent text in the file name to be executed as an Ex command.

Q: Which Vim versions are affected?

Vim versions earlier than 9.2.1011 are affected. The issue is in the C omni-completion script at runtime/autoload/ccomplete.vim.

Q: What can be done if updating is not immediately possible?

Avoid using C omni-completion with tags file names containing a bar character. Review the tags file paths returned by tagfiles() and remove or rename untrusted paths with that character.

Published Aug 25, 2026

Updated

Affected Software

1 affected component

vim Vim<9.2.1011

Frequently Asked Questions

What conditions are required for exploitation?

The user must invoke C omni-completion for a member access, and Vim must receive a tags file name from tagfiles() that contains a bar character. The bar terminates the constructed :vimgrep command, allowing subsequent text in the file name to be executed as an Ex command.

Which Vim versions are affected?

Vim versions earlier than 9.2.1011 are affected. The issue is in the C omni-completion script at runtime/autoload/ccomplete.vim.

What can be done if updating is not immediately possible?

Avoid using C omni-completion with tags file names containing a bar character. Review the tags file paths returned by tagfiles() and remove or rename untrusted paths with that character.