CVE-2026-59856: 
Vim vulnerability analysis and mitigation

CVE-2026-59856 is a code injection vulnerability in Vim's PHP omni-completion script (runtime/autoload/phpcomplete.vim) that allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. It affects all Vim versions prior to 9.2.0736 and was publicly disclosed on June 28, 2026, with the CVE assigned on July 9, 2026. The fix was released in Vim 9.2.0736. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.4 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper control of code generation (CWE-94): the phpcomplete#GetClassContentsStructure() function in runtime/autoload/phpcomplete.vim concatenates a class or trait name — taken directly from the buffer's contents — into a single-quoted search() pattern string that is executed via win_execute() without any escaping. A class name containing a single quote (') terminates the string argument early; because Vim honors the pipe character (|) as an Ex command separator, the remainder of the crafted name is interpreted and executed as arbitrary Ex commands. Via the :! command, this escalates to arbitrary OS command execution. Exploitation requires: filetype plugins enabled (the default in most distributions), the PHP omni-completion function active (omnifunc=phpcomplete#Complete), and the victim opening a malicious PHP file and manually invoking omni-completion with CTRL-X CTRL-O (GitHub Advisory, Fix Commit).

Successful exploitation results in arbitrary OS command execution with the full privileges of the Vim process (the victim user), yielding high confidentiality, integrity, and availability impact. An attacker who can deliver a crafted PHP file to a developer or system administrator using Vim can achieve code execution on the local system, potentially enabling credential theft, data exfiltration, persistence mechanisms, or lateral movement within a development environment. The scope is limited to the local system running Vim, but the impact is total within that context (GitHub Advisory, Red Hat Bugzilla).

1. Craft a malicious PHP file: Create a PHP file containing a class or trait declaration with a name that embeds a single quote and a pipe-separated Ex command payload, for example: class Foo'|call system('id > /tmp/pwned')| — this terminates the search() string early and injects an Ex command.
2. Deliver the file to the victim: Social-engineer or otherwise cause the target developer to open the crafted PHP file in Vim (e.g., via a repository, email attachment, or shared code review).
3. Ensure preconditions are met: Confirm the victim's Vim has filetype plugins enabled (default in most distributions via runtime/defaults.vim) and the PHP ftplugin sets omnifunc=phpcomplete#Complete.
4. Trigger omni-completion: The victim opens the file and invokes PHP omni-completion with CTRL-X CTRL-O while the cursor is positioned where class member completion would be triggered.
5. Achieve code execution: phpcomplete#GetClassContentsStructure() builds the unescaped search() call with the malicious class name, win_execute() runs it, the injected Ex command executes, and via :! arbitrary OS commands run with the victim's user privileges (GitHub Advisory, Fix Commit).

• File System: Presence of crafted PHP files containing class or trait names with embedded single quotes and pipe characters (e.g., class Foo'|call system(...)|); unexpected files created in /tmp or other writable directories by the user running Vim.
• Process: Unusual child processes spawned by the Vim process (e.g., sh, bash, curl, wget, python) shortly after omni-completion is invoked on a PHP file.
• Logs: Shell history or audit logs (auditd) showing unexpected command execution originating from the Vim process PID; syslog entries for processes spawned by the Vim user at the time of editing a PHP file.
• Network: Unexpected outbound network connections from a developer workstation initiated by a shell process that is a child of Vim, particularly to external IPs.

The primary remediation is to upgrade Vim to version 9.2.0736 or later, which fixes the vulnerability by properly quoting the class name using Vim's string() function before inserting it into the search() pattern (Fix Commit). Ubuntu has released security notice USN-8541-1, Red Hat has tracked the issue in Bugzilla, and openSUSE has issued security updates. Users who cannot upgrade immediately should avoid opening PHP files from untrusted sources and can disable PHP omni-completion by adding autocmd FileType php setlocal omnifunc= to their vimrc. Disabling filetype plugins entirely (filetype plugin off) also prevents the vulnerable code path from activating (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported, analyzed, and fixed by Hirohito Higashi (h-east), with the fix committed by Vim maintainer Christian Brabandt. The Vim project rated the severity as "Moderate" because exploitation requires the victim to manually invoke omni-completion rather than triggering on file open alone. Ubuntu, Red Hat, openSUSE, and other Linux distributions have issued or are tracking security advisories. Community coverage appeared on Linux security news sites and Bluesky, with general acknowledgment that the attack surface is limited to developers using Vim with PHP files from untrusted sources (GitHub Advisory, Red Hat Bugzilla).