CVE-2026-59856— Vim: Arbitrary Code Execution via PHP Omni-Completion
Possible ATT&CK Techniques 2AI
T1203 · Exploitation for Client Execution T1059 · Command and Scripting InterpreterGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-59856
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vim: Arbitrary Code Execution via PHP Omni-Completion
Source: NVD (National Vulnerability Database)
Vulnerability Description
Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-59856
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59856
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-59856 (1)
Vendor Advisories for CVE-2026-59856 (1)
Same Patch Batch · vim · 2026-07-09 · 3 CVEs total
| CVE-2026-59857 | Vim: Out-of-bounds Write in SAL Soundfolding | |
| CVE-2026-59858 | Vim: Arbitrary Code Execution via C Omni-Completion |
IV. Related Vulnerabilities
Same product: vim
- CVE-2026-59858
Vim: Arbitrary Code Execution via C Omni-Completion - CVE-2026-59857
Vim: Out-of-bounds Write in SAL Soundfolding - CVE-2026-55693
Vim: Out-of-bounds Write in Spell File Word Count - CVE-2026-55892
Vim: Out-of-bounds Write in Spell File Prefix Dump - CVE-2026-55895
Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() vi
Same vendor: vim
- CVE-2026-59858
Vim: Arbitrary Code Execution via C Omni-Completion - CVE-2026-59857
Vim: Out-of-bounds Write in SAL Soundfolding - CVE-2026-55693
Vim: Out-of-bounds Write in Spell File Word Count - CVE-2026-55892
Vim: Out-of-bounds Write in Spell File Prefix Dump - CVE-2026-55895
Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() vi
Same weakness: CWE-94
- CVE-2026-54769
Langroid: Sandbox Escape to Remote Code Execution via Incomp - CVE-2026-59858
Vim: Arbitrary Code Execution via C Omni-Completion - CVE-2026-59826
Metabase: Arbitrary Code Execution via Database Connection D - CVE-2026-59216
Open WebUI: Cross-user code-interpreter and tool execution v - CVE-2026-35211
OpenCTI: Elasticsearch Painless Script Injection via GraphQL
V. Comments for CVE-2026-59856
No comments yet