rpms/vim
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-57456: code execution via crafted docstrings in python complete

Browse Source 
Backport upstream commit cce141c42740f122dd8486ae04e21c2a81016ba8
to fix CVE-2026-57456: possible code execution with python complete
via crafted docstrings.

The fix replaces unsafe triple-quote string concatenation with
repr() in python3complete.vim and pythoncomplete.vim to properly
sanitize docstrings before exec(). A new test file adapted for
vim 8.0 is included to verify the fix.

CVE: CVE-2026-57456
Upstream patches:
 - cce141c427.patch
Resolves: RHEL-192102

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-04 09:32:12 +00:00
parent 4e3ff3d4fe
commit 7331b6f4ba
2 changed files with 155 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

144
0001-patch-9.2.0699-security-possible-code-execution-with.patch Normal file
View File

@ -0,0 +1,144 @@
From 578cdd1cd87dcf24959b2031f046932fdfcbe8ab Mon Sep 17 00:00:00 2001
From: Christian Brabandt <cb@256bit.org>
Date: Sun, 21 Jun 2026 19:50:56 +0000
Subject: [PATCH] patch 9.2.0699: [security]: possible code execution with
python complete
Problem: [security]: possible code execution with python complete
(morningbread)
Solution: Use repr() to quote the doc strings correctly
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3
Supported by AI
Signed-off-by: Christian Brabandt <cb@256bit.org>
---
runtime/autoload/python3complete.vim | 6 ++--
runtime/autoload/pythoncomplete.vim | 6 ++--
src/testdir/Make_all.mak | 1 +
src/testdir/test_plugin_python3complete.vim | 40 +++++++++++++++++++++
4 files changed, 47 insertions(+), 6 deletions(-)
create mode 100644 src/testdir/test_plugin_python3complete.vim
diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim
index cd8786d..86fd678 100644
--- a/runtime/autoload/python3complete.vim
+++ b/runtime/autoload/python3complete.vim
@@ -307,7 +307,7 @@ class Scope(object):
def get_code(self):
str = ""
- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n'
for sub in self.subscopes:
str += sub.get_code()
@@ -344,7 +344,7 @@ class Class(Scope):
str = '%sclass %s' % (self.currentindent(),self.name)
if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers)
str += ':\n'
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
if len(self.subscopes) > 0:
for s in self.subscopes: str += s.get_code()
else:
@@ -361,7 +361,7 @@ class Function(Scope):
def get_code(self):
str = "%sdef %s(%s):\n" % \
(self.currentindent(),self.name,','.join(self.params))
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
str += "%spass\n" % self.childindent()
return str
diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim
index a4dc18c..ea0499b 100644
--- a/runtime/autoload/pythoncomplete.vim
+++ b/runtime/autoload/pythoncomplete.vim
@@ -325,7 +325,7 @@ class Scope(object):
def get_code(self):
str = ""
- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n'
for sub in self.subscopes:
str += sub.get_code()
@@ -362,7 +362,7 @@ class Class(Scope):
str = '%sclass %s' % (self.currentindent(),self.name)
if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers)
str += ':\n'
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
if len(self.subscopes) > 0:
for s in self.subscopes: str += s.get_code()
else:
@@ -379,7 +379,7 @@ class Function(Scope):
def get_code(self):
str = "%sdef %s(%s):\n" % \
(self.currentindent(),self.name,','.join(self.params))
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
str += "%spass\n" % self.childindent()
return str
diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
index 4b34928..ed348a4 100644
--- a/src/testdir/Make_all.mak
+++ b/src/testdir/Make_all.mak
@@ -146,6 +146,7 @@ NEW_TESTS = test_arabic.res \
test_paste.res \
test_perl.res \
test_plugin_netrw.res \
+ test_plugin_python3complete.res \
test_plus_arg_edit.res \
test_preview.res \
test_profile.res \
diff --git a/src/testdir/test_plugin_python3complete.vim b/src/testdir/test_plugin_python3complete.vim
new file mode 100644
index 0000000..639d9ce
--- /dev/null
+++ b/src/testdir/test_plugin_python3complete.vim
@@ -0,0 +1,40 @@
+" Tests for the Python omni-completion plugin (runtime/autoload/python3complete.vim).
+
+if !has('python3')
+ finish
+endif
+
+func s:CompleteAndExpectNoMarker(buffer_lines, marker_path, msg)
+ call delete(a:marker_path)
+ let g:pythoncomplete_allow_import = 0
+ new
+ setfiletype python
+ call setline(1, a:buffer_lines)
+ call cursor(line('$'), col([line('$'), '$']))
+
+ silent! call python3complete#Complete(0, '')
+
+ call assert_false(filereadable(a:marker_path),
+ \ a:msg . ' (marker ' . a:marker_path . ' was created)')
+
+ bwipe!
+ call delete(a:marker_path)
+ unlet! g:pythoncomplete_allow_import
+endfunc
+
+func Test_python3complete_no_exec_via_class_docstring()
+ " A class-body docstring is emitted verbatim between triple quotes by
+ " get_code() and runs at class-definition time during exec(). A single-
+ " quoted source docstring lets an embedded """ survive doc()'s leading/
+ " trailing quote strip and break out of the generated literal.
+ let marker = tempname()
+ call s:CompleteAndExpectNoMarker([
+ \ 'class Foo:',
+ \ ' ''x"""+open("' . marker . '", "w").close()+"""y''',
+ \ ' pass',
+ \ 'Foo.',
+ \ ], marker,
+ \ 'class docstring expression was evaluated during omni-completion')
+endfunc
+
+" vim: shiftwidth=2 sts=2 expandtab

12
vim.spec
View File

@ -24,7 +24,7 @@ Summary: The VIM editor
URL: http://www.vim.org/
Name: vim
Version: %{baseversion}.%{patchlevel}
Release: 27%{?dist}
Release: 28%{?dist}
License: Vim and MIT
Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
Source1: vim.sh
@ -193,6 +193,11 @@ Patch3062: 0001-patch-9.2.0561-security-possible-code-execution-with.patch
# https://github.com/vim/vim/commit/868ad62cb8bf8038322eab2badd31bd98b02b9df
# stripped src/version.c hunk
Patch3063: 0001-patch-9.2.0568-pythoncomplete-g-pythoncomplete_allow.patch
# RHEL-192102 CVE-2026-57456 possible code execution with python complete
# https://redhat.atlassian.net/browse/RHEL-192102
# https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8
# stripped src/version.c hunk, omitted Last Updated comment changes, created minimal test file, adapted for vim 8.0
Patch3064: 0001-patch-9.2.0699-security-possible-code-execution-with.patch
# gcc is no longer in buildroot by default
@ -438,6 +443,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
%patch -P 3061 -p1 -b .netrw-injection
%patch -P 3062 -p1 -b .CVE-2026-52858
%patch -P 3063 -p1 -b .CVE-2026-52858-fix
%patch -P 3064 -p1 -b .CVE-2026-57456
%build
@ -957,6 +963,10 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
%{_datadir}/icons/locolor/*/apps/*
%changelog
* Sat Jul 04 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.0.1763-28
- RHEL-192102 CVE-2026-57456 vim: possible code execution with python
complete via crafted docstrings
* Wed Jul 01 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.0.1763-27
- RHEL-186656 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave
- RHEL-186648 CVE-2026-52858 vim: possible code execution with python3complete