Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package's top-level code as the editing user. This issue has been patched in version 9.2.0561.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
⚠️ Vulnerabilidades en productos Vim ❗ CVE-2026-52860 ❗ CVE-2026-52858 ❗ CVE-2026-47162 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-vim/ https://t.co/5yypSywmeZ
Post summary
Three new CVEs (2026-52860, 2026-52858, and 2026-47162) affecting Vim products are disclosed in the post, but no further technical details, PoC, active exploitation status, or patch information are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vim | vim | - | - | - |