rpms/vim
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-57456: possible code execution with python complete

Browse Source 
Backport upstream commit cce141c42740f122dd8486ae04e21c2a81016ba8
to fix a security vulnerability (CVE-2026-57456) where crafted
docstrings could trigger arbitrary code execution during Python
omni-completion. The fix replaces raw triple-quote concatenation
with repr() in both python3complete.vim and pythoncomplete.vim,
and adds a new test to verify the fix.

CVE: CVE-2026-57456
Upstream patches:
 - cce141c427.patch
Resolves: RHEL-192111

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-08-05 12:58:07 +00:00 committed by Zdenek Dohnal
parent df0792b607
commit 1788277db1
2 changed files with 185 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

173
0001-patch-9.2.0699-security-possible-code-execution-with.patch Normal file
View File

@ -0,0 +1,173 @@
From e94a0546625590b0f8f738246e4393f350e093dd Mon Sep 17 00:00:00 2001
From: Christian Brabandt <cb@256bit.org>
Date: Sun, 21 Jun 2026 19:50:56 +0000
Subject: [PATCH] patch 9.2.0699: [security]: possible code execution with
python complete
Problem: [security]: possible code execution with python complete
(morningbread)
Solution: Use repr() to quote the doc strings correctly
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3
Supported by AI
Signed-off-by: Christian Brabandt <cb@256bit.org>
---
runtime/autoload/python3complete.vim | 7 ++--
runtime/autoload/pythoncomplete.vim | 7 ++--
src/testdir/Make_all.mak | 2 +
src/testdir/test_plugin_python3complete.vim | 45 +++++++++++++++++++++
4 files changed, 55 insertions(+), 6 deletions(-)
create mode 100644 src/testdir/test_plugin_python3complete.vim
diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim
index ea0a33136..cb3d04548 100644
--- a/runtime/autoload/python3complete.vim
+++ b/runtime/autoload/python3complete.vim
@@ -14,6 +14,7 @@
" i.e. "import url<c-x,c-o>"
" Continue parsing on invalid line??
"
+
" v 0.10 by Vim project
" * disables importing local modules, unless the global Vim variable
" g:pythoncomplete_allow_import is set to non-zero
@@ -315,7 +316,7 @@ class Scope(object):
def get_code(self):
str = ""
- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n'
for sub in self.subscopes:
str += sub.get_code()
@@ -352,7 +353,7 @@ class Class(Scope):
str = '%sclass %s' % (self.currentindent(),self.name)
if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers)
str += ':\n'
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
if len(self.subscopes) > 0:
for s in self.subscopes: str += s.get_code()
else:
@@ -369,7 +370,7 @@ class Function(Scope):
def get_code(self):
str = "%sdef %s(%s):\n" % \
(self.currentindent(),self.name,','.join(self.params))
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
str += "%spass\n" % self.childindent()
return str
diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim
index aa28bb721..4ba8337b5 100644
--- a/runtime/autoload/pythoncomplete.vim
+++ b/runtime/autoload/pythoncomplete.vim
@@ -12,6 +12,7 @@
" i.e. "import url<c-x,c-o>"
" Continue parsing on invalid line??
"
+
" v 0.10 by Vim project
" * disables importing local modules, unless the global Vim variable
" g:pythoncomplete_allow_import is set to non-zero
@@ -330,7 +331,7 @@ class Scope(object):
def get_code(self):
str = ""
- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n'
for sub in self.subscopes:
str += sub.get_code()
@@ -367,7 +368,7 @@ class Class(Scope):
str = '%sclass %s' % (self.currentindent(),self.name)
if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers)
str += ':\n'
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
if len(self.subscopes) > 0:
for s in self.subscopes: str += s.get_code()
else:
@@ -384,7 +385,7 @@ class Function(Scope):
def get_code(self):
str = "%sdef %s(%s):\n" % \
(self.currentindent(),self.name,','.join(self.params))
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
str += "%spass\n" % self.childindent()
return str
diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
index 2b3d16d78..23360ce45 100644
--- a/src/testdir/Make_all.mak
+++ b/src/testdir/Make_all.mak
@@ -230,6 +230,7 @@ NEW_TESTS = \
test_plugin_ccomplete \
test_plugin_netrw \
test_plugin_phpcomplete \
+ test_plugin_python3complete \
test_plugin_tar \
test_plus_arg_edit \
test_popup \
@@ -483,6 +484,7 @@ NEW_TESTS_RES = \
test_plugin_ccomplete.res \
test_plugin_netrw.res \
test_plugin_phpcomplete.res \
+ test_plugin_python3complete.res \
test_plugin_tar.res \
test_plus_arg_edit.res \
test_popup.res \
diff --git a/src/testdir/test_plugin_python3complete.vim b/src/testdir/test_plugin_python3complete.vim
new file mode 100644
index 000000000..d83f65f3b
--- /dev/null
+++ b/src/testdir/test_plugin_python3complete.vim
@@ -0,0 +1,45 @@
+" Tests for the Python omni-completion plugin (runtime/autoload/python3complete.vim).
+"
+source check.vim
+CheckFeature python3
+
+" Run omni-completion against the given buffer contents and assert that the
+" marker file was not created. Pre-patch behaviour exec()s reconstructed
+" def/class headers, which evaluates the buffer-supplied expression and
+" creates the marker file. Post-patch, the expressions are stripped.
+func s:CompleteAndExpectNoMarker(buffer_lines, marker_path, msg)
+ call delete(a:marker_path)
+ defer delete(a:marker_path)
+ let g:pythoncomplete_allow_import = 0
+ new
+ setfiletype python
+ call setline(1, a:buffer_lines)
+ call cursor(line('$'), col([line('$'), '$']))
+
+ " The PoC trigger -- direct invocation of the omnifunc with an empty base.
+ " This is the same path Vim takes for CTRL-X CTRL-O.
+ silent! call python3complete#Complete(0, '')
+
+ call assert_false(filereadable(a:marker_path),
+ \ a:msg . ' (marker ' . a:marker_path . ' was created)')
+
+ bwipe!
+ unlet! g:pythoncomplete_allow_import
+endfunc
+
+func Test_python3complete_no_exec_via_class_docstring()
+ " A class-body docstring is emitted verbatim between triple quotes by
+ " get_code() and runs at class-definition time during exec(). A single-
+ " quoted source docstring lets an embedded """ survive doc()'s leading/
+ " trailing quote strip and break out of the generated literal.
+ let marker = tempname()
+ call s:CompleteAndExpectNoMarker([
+ \ 'class Foo:',
+ \ ' ''x"""+open("' . marker . '", "w").close()+"""y''',
+ \ ' pass',
+ \ 'Foo.',
+ \ ], marker,
+ \ 'class docstring expression was evaluated during omni-completion')
+endfunc
+
+" vim: shiftwidth=2 sts=2 expandtab

13
vim.spec
View File

@ -51,7 +51,7 @@ Summary: The VIM editor
URL: http://www.vim.org/
Name: vim
Version: %{baseversion}.%{patchlevel}
Release: 21%{?dist}
Release: 22%{?dist}
Epoch: 2
# swift.vim contains Apache 2.0 with runtime library exception:
# which is taken as Apache-2.0 WITH Swift-exception - reported to legal as https://gitlab.com/fedora/legal/fedora-license-data/-/issues/188
@ -187,6 +187,12 @@ Patch3030: 0001-patch-9.2.0495-security-runtime-netrw-code-injectio.patch
# https://github.com/vim/vim/commit/868ad62cb8bf8038322eab2badd31bd98b02b9df
Patch3031: 0001-patch-9.2.0561-security-possible-code-execution-with.patch
Patch3032: 0001-patch-9.2.0568-pythoncomplete-g-pythoncomplete_allow.patch
# RHEL-192111 CVE-2026-57456 vim: possible code execution with python complete
# https://redhat.atlassian.net/browse/RHEL-192111
# https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8
# adjusted: stripped src/version.c hunk, stripped Last Change comment updates,
# created standalone test file with build-system registration
Patch3033: 0001-patch-9.2.0699-security-possible-code-execution-with.patch
# uses autoconf in spec file
@ -537,6 +543,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
%patch -P 3030 -p1 -b .netrw-hist-inject
%patch -P 3031 -p1 -b .python3complete-import
%patch -P 3032 -p1 -b .pythoncomplete-allow-import
%patch -P 3033 -p1 -b .python-complete-exec
%build
cd src
@ -1167,6 +1174,10 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
%changelog
* Wed Aug 05 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:9.1.083-22
- RHEL-192111 CVE-2026-57456 vim: possible code execution with
python complete
* Wed Aug 05 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:9.1.083-21
- RHEL-186651 CVE-2026-52858 vim: possible code execution with
python3complete