From 1788277db1012a85e852389d5973073eae842d26 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Wed, 5 Aug 2026 12:58:07 +0000 Subject: [PATCH] Fix CVE-2026-57456: possible code execution with python complete Backport upstream commit cce141c42740f122dd8486ae04e21c2a81016ba8 to fix a security vulnerability (CVE-2026-57456) where crafted docstrings could trigger arbitrary code execution during Python omni-completion. The fix replaces raw triple-quote concatenation with repr() in both python3complete.vim and pythoncomplete.vim, and adds a new test to verify the fix. CVE: CVE-2026-57456 Upstream patches: - http://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8.patch Resolves: RHEL-192111 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- ...ecurity-possible-code-execution-with.patch | 173 ++++++++++++++++++ vim.spec | 13 +- 2 files changed, 185 insertions(+), 1 deletion(-) create mode 100644 0001-patch-9.2.0699-security-possible-code-execution-with.patch diff --git a/0001-patch-9.2.0699-security-possible-code-execution-with.patch b/0001-patch-9.2.0699-security-possible-code-execution-with.patch new file mode 100644 index 00000000..c8a510a7 --- /dev/null +++ b/0001-patch-9.2.0699-security-possible-code-execution-with.patch @@ -0,0 +1,173 @@ +From e94a0546625590b0f8f738246e4393f350e093dd Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Sun, 21 Jun 2026 19:50:56 +0000 +Subject: [PATCH] patch 9.2.0699: [security]: possible code execution with + python complete + +Problem: [security]: possible code execution with python complete + (morningbread) +Solution: Use repr() to quote the doc strings correctly + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3 + +Supported by AI + +Signed-off-by: Christian Brabandt +--- + runtime/autoload/python3complete.vim | 7 ++-- + runtime/autoload/pythoncomplete.vim | 7 ++-- + src/testdir/Make_all.mak | 2 + + src/testdir/test_plugin_python3complete.vim | 45 +++++++++++++++++++++ + 4 files changed, 55 insertions(+), 6 deletions(-) + create mode 100644 src/testdir/test_plugin_python3complete.vim + +diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim +index ea0a33136..cb3d04548 100644 +--- a/runtime/autoload/python3complete.vim ++++ b/runtime/autoload/python3complete.vim +@@ -14,6 +14,7 @@ + " i.e. "import url" + " Continue parsing on invalid line?? + " ++ + " v 0.10 by Vim project + " * disables importing local modules, unless the global Vim variable + " g:pythoncomplete_allow_import is set to non-zero +@@ -315,7 +316,7 @@ class Scope(object): + + def get_code(self): + str = "" +- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n' ++ if len(self.docstr) > 0: str += repr(self.docstr)+'\n' + str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n' + for sub in self.subscopes: + str += sub.get_code() +@@ -352,7 +353,7 @@ class Class(Scope): + str = '%sclass %s' % (self.currentindent(),self.name) + if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers) + str += ':\n' +- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n' ++ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n' + if len(self.subscopes) > 0: + for s in self.subscopes: str += s.get_code() + else: +@@ -369,7 +370,7 @@ class Function(Scope): + def get_code(self): + str = "%sdef %s(%s):\n" % \ + (self.currentindent(),self.name,','.join(self.params)) +- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n' ++ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n' + str += "%spass\n" % self.childindent() + return str + +diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim +index aa28bb721..4ba8337b5 100644 +--- a/runtime/autoload/pythoncomplete.vim ++++ b/runtime/autoload/pythoncomplete.vim +@@ -12,6 +12,7 @@ + " i.e. "import url" + " Continue parsing on invalid line?? + " ++ + " v 0.10 by Vim project + " * disables importing local modules, unless the global Vim variable + " g:pythoncomplete_allow_import is set to non-zero +@@ -330,7 +331,7 @@ class Scope(object): + + def get_code(self): + str = "" +- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n' ++ if len(self.docstr) > 0: str += repr(self.docstr)+'\n' + str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n' + for sub in self.subscopes: + str += sub.get_code() +@@ -367,7 +368,7 @@ class Class(Scope): + str = '%sclass %s' % (self.currentindent(),self.name) + if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers) + str += ':\n' +- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n' ++ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n' + if len(self.subscopes) > 0: + for s in self.subscopes: str += s.get_code() + else: +@@ -384,7 +385,7 @@ class Function(Scope): + def get_code(self): + str = "%sdef %s(%s):\n" % \ + (self.currentindent(),self.name,','.join(self.params)) +- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n' ++ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n' + str += "%spass\n" % self.childindent() + return str + +diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak +index 2b3d16d78..23360ce45 100644 +--- a/src/testdir/Make_all.mak ++++ b/src/testdir/Make_all.mak +@@ -230,6 +230,7 @@ NEW_TESTS = \ + test_plugin_ccomplete \ + test_plugin_netrw \ + test_plugin_phpcomplete \ ++ test_plugin_python3complete \ + test_plugin_tar \ + test_plus_arg_edit \ + test_popup \ +@@ -483,6 +484,7 @@ NEW_TESTS_RES = \ + test_plugin_ccomplete.res \ + test_plugin_netrw.res \ + test_plugin_phpcomplete.res \ ++ test_plugin_python3complete.res \ + test_plugin_tar.res \ + test_plus_arg_edit.res \ + test_popup.res \ +diff --git a/src/testdir/test_plugin_python3complete.vim b/src/testdir/test_plugin_python3complete.vim +new file mode 100644 +index 000000000..d83f65f3b +--- /dev/null ++++ b/src/testdir/test_plugin_python3complete.vim +@@ -0,0 +1,45 @@ ++" Tests for the Python omni-completion plugin (runtime/autoload/python3complete.vim). ++" ++source check.vim ++CheckFeature python3 ++ ++" Run omni-completion against the given buffer contents and assert that the ++" marker file was not created. Pre-patch behaviour exec()s reconstructed ++" def/class headers, which evaluates the buffer-supplied expression and ++" creates the marker file. Post-patch, the expressions are stripped. ++func s:CompleteAndExpectNoMarker(buffer_lines, marker_path, msg) ++ call delete(a:marker_path) ++ defer delete(a:marker_path) ++ let g:pythoncomplete_allow_import = 0 ++ new ++ setfiletype python ++ call setline(1, a:buffer_lines) ++ call cursor(line('$'), col([line('$'), '$'])) ++ ++ " The PoC trigger -- direct invocation of the omnifunc with an empty base. ++ " This is the same path Vim takes for CTRL-X CTRL-O. ++ silent! call python3complete#Complete(0, '') ++ ++ call assert_false(filereadable(a:marker_path), ++ \ a:msg . ' (marker ' . a:marker_path . ' was created)') ++ ++ bwipe! ++ unlet! g:pythoncomplete_allow_import ++endfunc ++ ++func Test_python3complete_no_exec_via_class_docstring() ++ " A class-body docstring is emitted verbatim between triple quotes by ++ " get_code() and runs at class-definition time during exec(). A single- ++ " quoted source docstring lets an embedded """ survive doc()'s leading/ ++ " trailing quote strip and break out of the generated literal. ++ let marker = tempname() ++ call s:CompleteAndExpectNoMarker([ ++ \ 'class Foo:', ++ \ ' ''x"""+open("' . marker . '", "w").close()+"""y''', ++ \ ' pass', ++ \ 'Foo.', ++ \ ], marker, ++ \ 'class docstring expression was evaluated during omni-completion') ++endfunc ++ ++" vim: shiftwidth=2 sts=2 expandtab diff --git a/vim.spec b/vim.spec index 1cf48738..c261cf18 100644 --- a/vim.spec +++ b/vim.spec @@ -51,7 +51,7 @@ Summary: The VIM editor URL: http://www.vim.org/ Name: vim Version: %{baseversion}.%{patchlevel} -Release: 21%{?dist} +Release: 22%{?dist} Epoch: 2 # swift.vim contains Apache 2.0 with runtime library exception: # which is taken as Apache-2.0 WITH Swift-exception - reported to legal as https://gitlab.com/fedora/legal/fedora-license-data/-/issues/188 @@ -187,6 +187,12 @@ Patch3030: 0001-patch-9.2.0495-security-runtime-netrw-code-injectio.patch # https://github.com/vim/vim/commit/868ad62cb8bf8038322eab2badd31bd98b02b9df Patch3031: 0001-patch-9.2.0561-security-possible-code-execution-with.patch Patch3032: 0001-patch-9.2.0568-pythoncomplete-g-pythoncomplete_allow.patch +# RHEL-192111 CVE-2026-57456 vim: possible code execution with python complete +# https://redhat.atlassian.net/browse/RHEL-192111 +# https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8 +# adjusted: stripped src/version.c hunk, stripped Last Change comment updates, +# created standalone test file with build-system registration +Patch3033: 0001-patch-9.2.0699-security-possible-code-execution-with.patch # uses autoconf in spec file @@ -537,6 +543,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk %patch -P 3030 -p1 -b .netrw-hist-inject %patch -P 3031 -p1 -b .python3complete-import %patch -P 3032 -p1 -b .pythoncomplete-allow-import +%patch -P 3033 -p1 -b .python-complete-exec %build cd src @@ -1167,6 +1174,10 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags %changelog +* Wed Aug 05 2026 RHEL Packaging Agent - 2:9.1.083-22 +- RHEL-192111 CVE-2026-57456 vim: possible code execution with + python complete + * Wed Aug 05 2026 RHEL Packaging Agent - 2:9.1.083-21 - RHEL-186651 CVE-2026-52858 vim: possible code execution with python3complete