CVE-2026-59856 Vim: Arbitrary Code Execution via PHP Omni-Completion
Attackers can execute arbitrary OS commands by tricking a victim into opening a crafted PHP file and triggering omni-completion in Vim.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-59856?
CVE-2026-59856 is a high-severity code injection vulnerability in Vim Vim, published on 9 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.
Weakness: CWE-94
Which versions are affected by CVE-2026-59856?
It affects 1 product.
Products include Vim Vim.
How do I fix CVE-2026-59856?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-59856 being exploited?
There is no known exploitation of CVE-2026-59856 in the wild and no public exploit code.
Other vulnerabilities in Vim Vim
Sources
Also known as ALPINE-CVE-2026-59856, AZL-92160, BELL-CVE-2026-59856, DEBIAN-CVE-2026-59856, ECHO-ee84-f5bb-81bf, GHSA-fh26-8f79-wj97 and 4 more.