https://seclists.org/oss-sec/2026/q4/138: [vim-security] Arbitrary Code Execution via Ruby Omni-Completion in Vim < 9.2.1177

Q: Which Vim installations are exposed?

Vim versions earlier than 9.2.1177 are affected when built with the Ruby interface. The Ruby filetype plugin configures Ruby omni-completion for Ruby buffers in those builds.

Q: What must happen for a crafted file to trigger the issue?

A user must edit a crafted Ruby file and invoke omni-completion after a variable reference. The crafted assignment can cause a Ruby expression to be evaluated as though it were a class name.

Q: Does disabling g:rubycomplete_buffer_loading prevent this issue?

No. The affected code path is not covered by g:rubycomplete_buffer_loading, despite the setting being documented as an opt-in for evaluating buffer code during completion.

Q: What can be done before upgrading?

Avoid invoking Ruby omni-completion on untrusted Ruby files. Disabling the Ruby omni-completion function for Ruby buffers also removes the described trigger path.

Published Oct 12, 2026

Updated

Affected Software

1 affected component

vim Vim<9.2.1177

Frequently Asked Questions

Which Vim installations are exposed?

Vim versions earlier than 9.2.1177 are affected when built with the Ruby interface. The Ruby filetype plugin configures Ruby omni-completion for Ruby buffers in those builds.

What must happen for a crafted file to trigger the issue?

A user must edit a crafted Ruby file and invoke omni-completion after a variable reference. The crafted assignment can cause a Ruby expression to be evaluated as though it were a class name.

Does disabling g:rubycomplete_buffer_loading prevent this issue?

No. The affected code path is not covered by g:rubycomplete_buffer_loading, despite the setting being documented as an opt-in for evaluating buffer code during completion.

What can be done before upgrading?

Avoid invoking Ruby omni-completion on untrusted Ruby files. Disabling the Ruby omni-completion function for Ruby buffers also removes the described trigger path.