CVE-2026-57456Disclosure(vim / vim)

これ、絶対、生成AIがらみの脆弱性探索の結果でしょ。迷惑な。Vim直撃でCVEが8件並ぶの、地味に見えて運用泣かせです。CVE-2026-57456はPython omni-completion docstrings経由のArbitrary Code Execution、57453はzip.vimのPowerShell command injection。エディタはEDRの目線から外れがちなのが怖い。 開発端末と踏み台のVim/Neovim派生、Windowsでのzip.vim利用、netrw有効環境、spell file配布経路を棚卸しかな。たかがエディタ、されどエディタ。粛々と対策していこう #セキュリティ https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57456

🚨 HIGH - Vim Python omni-completion docstring exec() code injection (CVE-2026-57456) Vim’s Python omni-completion scripts are vulnerable because they reconstruct function/class definitions from the current buffer and execute them via Python exec(), making the completion component itself the affected surface. The root cause is improper input sanitization/injection: docstrings are embedded verbatim into triple-quoted Python strings without escaping, enabling code injection. An attacker can exploit this by getting a developer to open or paste a crafted buffer/file and then trigger omni-completion, which causes the injected payload to execute under the user’s privileges. Impact is arbitrary code execution in the context of the Vim user, enabling data theft, persistence, or launching follow-on attacks from the workstation. 👉 Affected: vim < 9.2.0699 | Upgrade to 9.2.0699