https://seclists.org/oss-sec/2026/q4/138: [vim-security] Arbitrary Code Execution via Ruby Omni-Completion in Vim < 9.2.1177
Published Oct 12, 2026
·Updated
Affected Software
1 affected component
vim Vim<9.2.1177
Vim versions earlier than 9.2.1177 are affected when built with the Ruby interface. The Ruby filetype plugin configures Ruby omni-completion for Ruby buffers in those builds.
A user must edit a crafted Ruby file and invoke omni-completion after a variable reference. The crafted assignment can cause a Ruby expression to be evaluated as though it were a class name.
No. The affected code path is not covered by g:rubycomplete_buffer_loading, despite the setting being documented as an opt-in for evaluating buffer code during completion.
Avoid invoking Ruby omni-completion on untrusted Ruby files. Disabling the Ruby omni-completion function for Ruby buffers also removes the described trigger path.