Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-09T22:39:01 vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CWE-94

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.

A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remote attacker to achieve arbitrary operating-system command execution.

Red Hat Product Security has rated this vulnerability as having a Moderate impact. While successful exploitation allows for arbitrary operating-system command execution when a user opens a crafted PHP file and triggers omni-completion, this feature is disabled by default in Red Hat products. The requirement for a non-default configuration, combined with mandatory user interaction, significantly reduces the real-world risk." Users should exercise caution when opening untrusted PHP files and avoid invoking omni-completion on them. To prevent exploitation, the PHP omni-completion script can be disabled by moving or renaming `phpcomplete.vim`. For example, execute `mv /usr/share/vim/vim*/autoload/phpcomplete.vim /usr/share/vim/vim*/autoload/phpcomplete.vim.bak`. This action will disable PHP omni-completion functionality. A restart of Vim is necessary for this change to take effect. Red Hat Hardened Images 2026-07-03T00:00:00Z RHSA-2026:35387 vim-main-9.2.780-1.hum1 Red Hat Enterprise Linux 10 Affected vim Red Hat Enterprise Linux 6 Affected vim Red Hat Enterprise Linux 7 Affected vim Red Hat Enterprise Linux 8 Affected vim Red Hat Enterprise Linux 9 Affected vim Red Hat OpenShift Container Platform 4 Affected rhcos https://www.cve.org/CVERecord?id=CVE-2026-59856 https://nvd.nist.gov/vuln/detail/CVE-2026-59856 https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24 https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97