← CVE Radar
CVE-2026-59856Vim: Arbitrary Code Execution via PHP Omni-Completion
Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.
8.4 HIGHEPSS 0.21%Not in KEVNVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.4 | HIGH | 4.0GitHub_M (CNA) | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 7.8 | HIGH | 3.1NVD | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2026-59856
- Status
- Analyzed
- Assigner (CNA)
- GitHub_M
- Published
- Jul 9, 2026
- Last modified
- 2026-07-14 05:16 UTC
- Weaknesses
- CWE-94 · Improper Control of Generation of Code ('Code Injection')
Affected Products
As published by the CNA in the CVE record.
vimvim1 version range
- < 9.2.0736