Описание
Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package's top-level code as the editing user. This issue has been patched in version 9.2.0561.
A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a sibling Python package. This could lead to a complete compromise of the user's system.
Отчет
This is an Important vulnerability in Vim that allows a local attacker to achieve arbitrary code execution. The flaw occurs when a user opens a specially crafted Python file and invokes omni-completion, leading to the execution of malicious code from a co-located Python package. This risk is present in Red Hat Enterprise Linux and other products where Vim is deployed with Python omni-completion enabled, potentially compromising the editing user's system.
Меры по смягчению последствий
Users can mitigate this vulnerability by disabling Python omni-completion in Vim if it is not essential for their workflow. This prevents the execution of untrusted Python code when opening hostile files. To disable this feature, ensure that the omnifunc option in your Vim configuration (e.g., ~/.vimrc) is not set to pythoncomplete#Complete or python3complete#Complete. Alternatively, users should avoid invoking omni-completion (Ctrl-X Ctrl-O) on Python files from untrusted sources. Disabling Python omni-completion may affect Python development functionality within Vim.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 5 | openshift/ose-rhel-coreos-9 | Affected | ||
| Red Hat Enterprise Linux 10 | vim | Fixed | RHSA-2026:38509 | 13.07.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | vim | Fixed | RHSA-2026:55431 | 17.08.2026 |
| Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION | vim | Fixed | RHSA-2026:69128 | 21.09.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | vim | Fixed | RHSA-2026:68711 | 17.09.2026 |
| Red Hat Enterprise Linux 8 | vim | Fixed | RHSA-2026:38510 | 13.07.2026 |
| Red Hat Enterprise Linux 8 | vim | Fixed | RHSA-2026:38510 | 13.07.2026 |
| Red Hat Enterprise Linux 9 | vim | Fixed | RHSA-2026:38511 | 13.07.2026 |
| Red Hat Enterprise Linux 9 | vim | Fixed | RHSA-2026:38511 | 13.07.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.3 High
CVSS3
Связанные уязвимости
Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package's top-level code as the editing user. This issue has been patched in version 9.2.0561.
Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package's top-level code as the editing user. This issue has been patched in version 9.2.0561.
Vim is an open source, command line text editor. Prior to version 9.2. ...
EPSS
7.3 High
CVSS3