CVE-2026-59856

Katalog CVE

CVSS 7.8 · High EPSS 0,22%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada vim. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.

Rincian

Terbit di NVD

9 Juli 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 11,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97 exploit · patch · advisory vendor
• https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24 patch