Fix CVE(s): CVE-2026-52858, CVE-2026-52860
* SECURITY UPDATE: arbitrary code execution in the python and python3 omni-completion plugins: Completer.evalsource() executed import and from statements harvested from the current buffer through Python's import machinery, and because the buffer's directory is on sys.path, opening a hostile .py file alongside a sibling package ran attacker controlled code on omni-completion. - debian/patches/CVE-2026-52858.patch: skip execution of buffer level import/from statements unless the user opts in by setting g:pythoncomplete_allow_import, and re-import the vim module inside evalsource() so the opt-in is honoured, in runtime/autoload/python3complete.vim and runtime/autoload/pythoncomplete.vim; matches upstream patches 9.2.0561 and 9.2.0568. - CVE-2026-52858 * SECURITY UPDATE: arbitrary code execution in the python and python3 omni-completion plugins: the completion code reconstructed function and class definitions from the current buffer and ran them through exec(), and because Python evaluates parameter default values, parameter annotations and class base expressions at definition time, a hostile buffer could execute attacker controlled expressions via crafted def/class headers; the g:pythoncomplete_allow_import mitigation did not cover this path. - debian/patches/CVE-2026-52860.patch: strip default values and annotations from reconstructed function parameter lists and whitelist class base lists to dotted names before the generated source reaches exec(), in runtime/autoload/python3co
- Products
- vim, vim-athena, vim-athena-py2, vim-common, vim-doc, vim-gnome, vim-gnome-py2, vim-gtk, vim-gtk-py2, vim-gtk3, vim-gtk3-py2, vim-gui-common, vim-nox, vim-nox-py2, vim-runtime, vim-tiny
- Affected versions
- Not specified
- Fixed versions
- 3:7.4.1689-3ubuntu1.5+tuxcare.els69
- CVEs
- CVE-2026-52858, CVE-2026-52860
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:39 UTC · Revision 1
Source evidence
Fix CVE(s): CVE-2026-52858, CVE-2026-52860
core-osv · Original sourcePublished 24 Jun 2026, 09:54 UTC
* SECURITY UPDATE: arbitrary code execution in the python and python3 omni-completion plugins: Completer.evalsource() executed import and from statements harvested from the current buffer through Python's import machinery, and because the buffer's directory is on sys.path, opening a hostile .py file alongside a sibling package ran attacker controlled code on omni-completion. - debian/patches/CVE-2026-52858.patch: skip execution of buffer level import/from statements unless the user opts in by setting g:pythoncomplete_allow_import, and re-import the vim module inside evalsource() so the opt-in is honoured, in runtime/autoload/python3complete.vim and runtime/autoload/pythoncomplete.vim; matches upstream patches 9.2.0561 and 9.2.0568. - CVE-2026-52858 * SECURITY UPDATE: arbitrary code execution in the python and python3 omni-completion plugins: the completion code reconstructed function and class definitions from the current buffer and ran them through exec(), and because Python evaluates parameter default values, parameter annotations and class base expressions at definition time, a hostile buffer could execute attacker controlled expressions via crafted def/class headers; the g:pythoncomplete_allow_import mitigation did not cover this path. - debian/patches/CVE-2026-52860.patch: strip default values and annotations from reconstructed function parameter lists and whitelist class base lists to dotted names before the generated source reaches exec(), in runtime/autoload/python3co
osv:CLSA-2026-1782294876
vim
Fixed versions: 3:7.4.1689-3ubuntu1.5+tuxcare.els69
vim-athena
Fixed versions: 3:7.4.1689-3ubuntu1.5+tuxcare.els69
vim-athena-py2
Fixed versions: 3:7.4.1689-3ubuntu1.5+tuxcare.els69
vim-common
Fixed versions: 3:7.4.1689-3ubuntu1.5+tuxcare.els69
vim-doc
Fixed versions: 3:7.4.1689-3ubuntu1.5+tuxcare.els69
vim-gnome
Fixed versions: 3:7.4.1689-3ubuntu1.5+tuxcare.els69
vim-gnome-py2
Fixed versions: 3:7.4.1689-3ubuntu1.5+tuxcare.els69
vim-gtk
Fixed versions: 3:7.4.1689-3ubuntu1.5+tuxcare.els69
vim-gtk-py2
Fixed versions: 3:7.4.1689-3ubuntu1.5+tuxcare.els69
vim-gtk3
Fixed versions: 3:7.4.1689-3ubuntu1.5+tuxcare.els69
vim-gtk3-py2
Fixed versions: 3:7.4.1689-3ubuntu1.5+tuxcare.els69
vim-gui-common
Fixed versions: 3:7.4.1689-3ubuntu1.5+tuxcare.els69
vim-nox
Fixed versions: 3:7.4.1689-3ubuntu1.5+tuxcare.els69
vim-nox-py2
Fixed versions: 3:7.4.1689-3ubuntu1.5+tuxcare.els69
vim-runtime
Fixed versions: 3:7.4.1689-3ubuntu1.5+tuxcare.els69
vim-tiny
Fixed versions: 3:7.4.1689-3ubuntu1.5+tuxcare.els69
Complete source record
{
"id": "f90f8d38112cf3240c97eb985c0b805a47674301355561b834239aaad2a94971",
"url": "https://osv.dev/vulnerability/CLSA-2026-1782294876",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Fix CVE(s): CVE-2026-52858, CVE-2026-52860",
"summary": "* SECURITY UPDATE: arbitrary code execution in the python and python3 omni-completion plugins: Completer.evalsource() executed import and from statements harvested from the current buffer through Python's import machinery, and because the buffer's directory is on sys.path, opening a hostile .py file alongside a sibling package ran attacker controlled code on omni-completion. - debian/patches/CVE-2026-52858.patch: skip execution of buffer level import/from statements unless the user opts in by setting g:pythoncomplete_allow_import, and re-import the vim module inside evalsource() so the opt-in is honoured, in runtime/autoload/python3complete.vim and runtime/autoload/pythoncomplete.vim; matches upstream patches 9.2.0561 and 9.2.0568. - CVE-2026-52858 * SECURITY UPDATE: arbitrary code execution in the python and python3 omni-completion plugins: the completion code reconstructed function and class definitions from the current buffer and ran them through exec(), and because Python evaluates parameter default values, parameter annotations and class base expressions at definition time, a hostile buffer could execute attacker controlled expressions via crafted def/class headers; the g:pythoncomplete_allow_import mitigation did not cover this path. - debian/patches/CVE-2026-52860.patch: strip default values and annotations from reconstructed function parameter lists and whitelist class base lists to dotted names before the generated source reaches exec(), in runtime/autoload/python3co",
"evidence": "osv:CLSA-2026-1782294876",
"products": [
{
"name": {
"value": "vim",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:7.4.1689-3ubuntu1.5+tuxcare.els69",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-athena",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:7.4.1689-3ubuntu1.5+tuxcare.els69",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-athena-py2",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:7.4.1689-3ubuntu1.5+tuxcare.els69",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-common",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:7.4.1689-3ubuntu1.5+tuxcare.els69",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-doc",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:7.4.1689-3ubuntu1.5+tuxcare.els69",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-gnome",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:7.4.1689-3ubuntu1.5+tuxcare.els69",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-gnome-py2",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:7.4.1689-3ubuntu1.5+tuxcare.els69",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-gtk",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:7.4.1689-3ubuntu1.5+tuxcare.els69",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-gtk-py2",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:7.4.1689-3ubuntu1.5+tuxcare.els69",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-gtk3",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:7.4.1689-3ubuntu1.5+tuxcare.els69",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-gtk3-py2",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:7.4.1689-3ubuntu1.5+tuxcare.els69",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-gui-common",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:7.4.1689-3ubuntu1.5+tuxcare.els69",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-nox",
"evidence": "/affected/12/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:7.4.1689-3ubuntu1.5+tuxcare.els69",
"evidence": "/affected/12/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-nox-py2",
"evidence": "/affected/13/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:7.4.1689-3ubuntu1.5+tuxcare.els69",
"evidence": "/affected/13/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-runtime",
"evidence": "/affected/14/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:7.4.1689-3ubuntu1.5+tuxcare.els69",
"evidence": "/affected/14/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-tiny",
"evidence": "/affected/15/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:7.4.1689-3ubuntu1.5+tuxcare.els69",
"evidence": "/affected/15/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1782294876",
"aliases": [
"CLSA-2026-1782294876"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:7.4.1689-3ubuntu1.5+tuxcare.els69"
}
]
}
],
"package": {
"name": "vim",
"purl": "pkg:deb/tuxcare/vim?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:7.4.1689-3ubuntu1.5+tuxcare.els69"
}
]
}
],
"package": {
"name": "vim-athena",
"purl": "pkg:deb/tuxcare/vim-athena?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:7.4.1689-3ubuntu1.5+tuxcare.els69"
}
]
}
],
"package": {
"name": "vim-athena-py2",
"purl": "pkg:deb/tuxcare/vim-athena-py2?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:7.4.1689-3ubuntu1.5+tuxcare.els69"
}
]
}
],
"package": {
"name": "vim-common",
"purl": "pkg:deb/tuxcare/vim-common?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:7.4.1689-3ubuntu1.5+tuxcare.els69"
}
]
}
],
"package": {
"name": "vim-doc",
"purl": "pkg:deb/tuxcare/vim-doc?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:7.4.1689-3ubuntu1.5+tuxcare.els69"
}
]
}
],
"package": {
"name": "vim-gnome",
"purl": "pkg:deb/tuxcare/vim-gnome?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:7.4.1689-3ubuntu1.5+tuxcare.els69"
}
]
}
],
"package": {
"name": "vim-gnome-py2",
"purl": "pkg:deb/tuxcare/vim-gnome-py2?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:7.4.1689-3ubuntu1.5+tuxcare.els69"
}
]
}
],
"package": {
"name": "vim-gtk",
"purl": "pkg:deb/tuxcare/vim-gtk?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:7.4.1689-3ubuntu1.5+tuxcare.els69"
}
]
}
],
"package": {
"name": "vim-gtk-py2",
"purl": "pkg:deb/tuxcare/vim-gtk-py2?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:7.4.1689-3ubuntu1.5+tuxcare.els69"
}
]
}
],
"package": {
"name": "vim-gtk3",
"purl": "pkg:deb/tuxcare/vim-gtk3?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:7.4.1689-3ubuntu1.5+tuxcare.els69"
}
]
}
],
"package": {
"name": "vim-gtk3-py2",
"purl": "pkg:deb/tuxcare/vim-gtk3-py2?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:7.4.1689-3ubuntu1.5+tuxcare.els69"
}
]
}
],
"package": {
"name": "vim-gui-common",
"purl": "pkg:deb/tuxcare/vim-gui-common?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:7.4.1689-3ubuntu1.5+tuxcare.els69"
}
]
}
],
"package": {
"name": "vim-nox",
"purl": "pkg:deb/tuxcare/vim-nox?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:7.4.1689-3ubuntu1.5+tuxcare.els69"
}
]
}
],
"package": {
"name": "vim-nox-py2",
"purl": "pkg:deb/tuxcare/vim-nox-py2?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:7.4.1689-3ubuntu1.5+tuxcare.els69"
}
]
}
],
"package": {
"name": "vim-runtime",
"purl": "pkg:deb/tuxcare/vim-runtime?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:7.4.1689-3ubuntu1.5+tuxcare.els69"
}
]
}
],
"package": {
"name": "vim-tiny",
"purl": "pkg:deb/tuxcare/vim-tiny?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"
}
}
],
"modified": "2026-10-26T09:32:01.712542713Z",
"provider": "osv",
"upstream": [
"CVE-2026-52858",
"CVE-2026-52860"
],
"references": [
"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1782294876.html",
"https://nvd.nist.gov/vuln/detail/CVE-2026-52858",
"https://nvd.nist.gov/vuln/detail/CVE-2026-52860"
]
},
"related_cves": [
{
"value": "CVE-2026-52858",
"evidence": "/upstream"
},
{
"value": "CVE-2026-52860",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 449400,
"published_at": "2026-06-24T09:54:56+00:00"
}