CVE-2026-59858— Vim: Arbitrary Code Execution via C Omni-Completion
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-59858
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vim: Arbitrary Code Execution via C Omni-Completion
Source: NVD (National Vulnerability Database)
Vulnerability Description
Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Vim 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Vim是Vim组织开源的一款跨平台的文本编辑器。 Vim 9.2.0735之前版本存在代码注入漏洞，该漏洞源于C omni-completion脚本未正确转义tags条目的typeref:或typename:扩展字段，将其插入到通过:execute运行的:vimgrep模式中，可能导致精心构造的标签字段关闭搜索模式并附加任意Ex命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-59858
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59858
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-59858 (1)
Vendor Advisories for CVE-2026-59858 (1)
Same Patch Batch · vim · 2026-07-09 · 3 CVEs total
| CVE-2026-59857 | Vim: Out-of-bounds Write in SAL Soundfolding | |
| CVE-2026-59856 | Vim: Arbitrary Code Execution via PHP Omni-Completion |
IV. Related Vulnerabilities
Same product: vim
- CVE-2026-59856
Vim: Arbitrary Code Execution via PHP Omni-Completion - CVE-2026-59857
Vim: Out-of-bounds Write in SAL Soundfolding - CVE-2026-55693
Vim: Out-of-bounds Write in Spell File Word Count - CVE-2026-55892
Vim: Out-of-bounds Write in Spell File Prefix Dump - CVE-2026-55895
Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() vi
Same vendor: vim
- CVE-2026-59856
Vim: Arbitrary Code Execution via PHP Omni-Completion - CVE-2026-59857
Vim: Out-of-bounds Write in SAL Soundfolding - CVE-2026-55693
Vim: Out-of-bounds Write in Spell File Word Count - CVE-2026-55892
Vim: Out-of-bounds Write in Spell File Prefix Dump - CVE-2026-55895
Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() vi
Same weakness: CWE-94
- CVE-2026-55771
CedarJava has policy injection, type confusion, and incorrec - CVE-2026-55773
CedarJava has a policy injection vulnerability - CVE-2026-12257
Remote code execution in Mura Software’s CMS - CVE-2026-57811
WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remo - CVE-2026-14453
A user with low privileges can inject SSTI templates that ca
V. Comments for CVE-2026-59858
No comments yet