CVE-2026-52860: Vim: Arbitrary Code Execution via Python Omni-Completion

Synopsis

This is an arbitrary code execution vulnerability in Vim's Python omni-completion feature. The flaw is reachable over the network with no authentication required, but a victim must open a maliciously crafted file and trigger omni-completion, making user interaction a necessary step. Successful exploitation gives an attacker full control over the victim's process, including the ability to read, modify, or destroy data accessible to that user. A patched-image rebuild at version 9.2.0597 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attack is delivered over the network, typically by distributing a hostile file to a victim who opens it in Vim.

• AuthenticationNot required

  No account or credential on the target system is required; the attacker only needs to get the victim to open a crafted file.

• Victim interactionRequired

  The victim must open the attacker-controlled buffer and trigger Python omni-completion, making social engineering a prerequisite.

• Attack complexityDetail

  While the exploit itself is reliable and condition-free once the file is opened, the CVSS attack requirements note an additional prerequisite condition (AT:P), meaning specific deployment or configuration circumstances must be present.

Blast Radius

• Attacker executes arbitrary Python expressions with the privileges of the user running Vim, gaining full code execution in that process context.
• Confidential data readable by that user, including files, environment variables, and credentials in memory, is directly accessible.
• The attacker can write or overwrite files accessible to the victim user, modifying source code, configuration, or other persisted data.
• The running Vim process and any subprocess it spawns can be crashed or hijacked, disrupting the victim's workflow and any dependent tooling.