CVE-2026-59856Disclosure(vim / vim)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch vim vim systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.

vim CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97

Weakness type (CWE)

CWE-94

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-07-10); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

vim

Products

vim

Deep dive

Activity timeline3 mentions / 2d

Signal classification3 categories

Disclosure

133.3%

General

133.3%

Patch

133.3%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2026-59856

Classification over time

Date	Total	Labels

2026-07-10	2	Disclosure1General1
2026-07-12	1	Patch1

Full discourse3 posts

connect24h@connect24h90d
Patch
こういう地味にでかい穴は困るっちゅうねん。絶対、Mythosが見つけたんやろがぁ。Vim 9.2.0736未満は、細工されたPHPでOmni-Completionを実行すると任意のOScommandを実行され得る（CVE-2026-59856）。開発端末を狙うACEとして見過ごせない。発火条件はfiletype pluginが有効で、omnifunc=phpcomplete#Completeを使用し、利用者が補完を呼び出すこと。ファイルを開くだけでは発火しないが、補完操作を信頼境界にする設計は正直つらい。攻撃コードはVim利用者の権限で動く。初動では「vim --version」「:set omnifunc?」で端末と設定を棚卸しし、9.2.0736以降または各distributionの修正版へ更新してほしい。更新まで外部由来PHPでOmni-Completionを使わない。開発端末の資格情報まで奪われる前に確認が急務だ。 #セキュリティ
Post summary
The post highlights a CVE‑2026‑59856 flaw in Vim that allows OS command execution via manipulated PHP Omni‑Completion, and urges users to update to 9.2.0736+ or disable external PHP to mitigate the risk.
11020314
6.8K followersView on X
CVE@CVEnew92d
General
CVE-2026-59856 Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait n… https://www.cve.org/CVERecord?id=CVE-2026-59856
Post summary
The text provides a minimal reference to CVE‑2026‑59856 concerning a Vim script that interpolates a class or trait, without further technical detail or actionable information.
00000677
57.8K followersView on X
Upwind Security MDR@UpwindMDR92d
Disclosure
🚨High - Vim PHP Omni-Completion Command Injection (CVE-2026-59856) Vim's PHP omni-completion script (phpcomplete.vim) interpolates a class/trait name taken from the edited buffer into a search() pattern run via win_execute() without escaping. A name with a single quote terminates the search() argument early, and since | is honored as an Ex command separator, the rest of the name runs as Ex commands - and via :! that becomes arbitrary OS command execution. Exploitation requires a victim to open a crafted PHP file in Vim and invoke omni-completion (Ctrl-X Ctrl-O) - a realistic scenario for anyone editing untrusted PHP source. 👉Upgrade Vim to 9.2.0736.
Post summary
A new vulnerability (CVE‑2026‑59856) in Vim’s phpcomplete.vim allows arbitrary OS command execution through unescaped class/trait names; mitigated by upgrading to Vim 9.2.0736.
0000085
246 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	vim	vim	-	-	-

Explore more

Back to dashboard vim CVEs vim vulnerabilities