rpms/vim
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-57456: code execution via crafted docstrings in python complete

Browse Source 
Backport upstream commit cce141c42740 (patch 9.2.0699) to fix a
security vulnerability where crafted docstrings could lead to
arbitrary code execution during Python omni-completion.

The fix replaces triple-quoted string insertion with repr() in
Scope.get_code(), Function.get_code(), and Class.get_code() in
both python3complete.vim and pythoncomplete.vim. A new test file
is included to verify the fix.

CVE: CVE-2026-57456
Upstream patches:
 - cce141c427.patch
Resolves: RHEL-192114

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-30 09:28:25 +00:00 committed by Zdenek Dohnal
parent e86a577c2e
commit ed8b07e0b5
2 changed files with 182 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

169
0001-patch-9.2.0699-security-possible-code-execution-with.patch Normal file
View File

@ -0,0 +1,169 @@
From e9d7f6f8ad1e7376311ce7af7f0f038fce381176 Mon Sep 17 00:00:00 2001
From: Christian Brabandt <cb@256bit.org>
Date: Sun, 21 Jun 2026 19:50:56 +0000
Subject: [PATCH] patch 9.2.0699: [security]: possible code execution with
python complete
Problem: [security]: possible code execution with python complete
(morningbread)
Solution: Use repr() to quote the doc strings correctly
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3
Supported by AI
Signed-off-by: Christian Brabandt <cb@256bit.org>
---
runtime/autoload/python3complete.vim | 7 ++--
runtime/autoload/pythoncomplete.vim | 7 ++--
src/testdir/Make_all.mak | 2 +
src/testdir/test_plugin_python3complete.vim | 41 +++++++++++++++++++++
4 files changed, 51 insertions(+), 6 deletions(-)
create mode 100644 src/testdir/test_plugin_python3complete.vim
diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim
index 6894bd63e..55ccadca4 100644
--- a/runtime/autoload/python3complete.vim
+++ b/runtime/autoload/python3complete.vim
@@ -14,6 +14,7 @@
" i.e. "import url<c-x,c-o>"
" Continue parsing on invalid line??
"
+
" v 0.9
" * Fixed docstring parsing for classes and functions
" * Fixed parsing of *args and **kwargs type arguments
@@ -296,7 +297,7 @@ class Scope(object):
def get_code(self):
str = ""
- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
for l in self.locals:
if l.startswith('import'): str += l+'\n'
str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n'
@@ -335,7 +336,7 @@ class Class(Scope):
str = '%sclass %s' % (self.currentindent(),self.name)
if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers)
str += ':\n'
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
if len(self.subscopes) > 0:
for s in self.subscopes: str += s.get_code()
else:
@@ -352,7 +353,7 @@ class Function(Scope):
def get_code(self):
str = "%sdef %s(%s):\n" % \
(self.currentindent(),self.name,','.join(self.params))
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
str += "%spass\n" % self.childindent()
return str
diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim
index 5f6fee58c..19b96c1d2 100644
--- a/runtime/autoload/pythoncomplete.vim
+++ b/runtime/autoload/pythoncomplete.vim
@@ -12,6 +12,7 @@
" i.e. "import url<c-x,c-o>"
" Continue parsing on invalid line??
"
+
" v 0.9
" * Fixed docstring parsing for classes and functions
" * Fixed parsing of *args and **kwargs type arguments
@@ -314,7 +315,7 @@ class Scope(object):
def get_code(self):
str = ""
- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
for l in self.locals:
if l.startswith('import'): str += l+'\n'
str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n'
@@ -353,7 +354,7 @@ class Class(Scope):
str = '%sclass %s' % (self.currentindent(),self.name)
if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers)
str += ':\n'
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
if len(self.subscopes) > 0:
for s in self.subscopes: str += s.get_code()
else:
@@ -370,7 +371,7 @@ class Function(Scope):
def get_code(self):
str = "%sdef %s(%s):\n" % \
(self.currentindent(),self.name,','.join(self.params))
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
str += "%spass\n" % self.childindent()
return str
diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
index c5d6e01..f1a2b3c 100644
--- a/src/testdir/Make_all.mak
+++ b/src/testdir/Make_all.mak
@@ -213,6 +213,7 @@ NEW_TESTS = \
test_plugin_ccomplete \
test_plugin_tar \
test_plugin_phpcomplete \
+ test_plugin_python3complete \
test_plus_arg_edit \
test_popup \
test_popupwin \
@@ -454,6 +455,7 @@ NEW_TESTS_RES = \
test_plugin_ccomplete.res \
test_plugin_tar.res \
test_plugin_phpcomplete.res \
+ test_plugin_python3complete.res \
test_plus_arg_edit.res \
test_popup.res \
test_popupwin.res \
diff --git a/src/testdir/test_plugin_python3complete.vim b/src/testdir/test_plugin_python3complete.vim
new file mode 100644
index 000000000..80eae4f30
--- /dev/null
+++ b/src/testdir/test_plugin_python3complete.vim
@@ -0,0 +1,41 @@
+" Tests for the Python omni-completion plugin (runtime/autoload/python3complete.vim).
+"
+source check.vim
+CheckFeature python3
+
+" Run omni-completion against the given buffer contents and assert that the
+" marker file was not created.
+func s:CompleteAndExpectNoMarker(buffer_lines, marker_path, msg)
+ call delete(a:marker_path)
+ new
+ setfiletype python
+ call setline(1, a:buffer_lines)
+ call cursor(line('$'), col([line('$'), '$']))
+
+ " The PoC trigger -- direct invocation of the omnifunc with an empty base.
+ " This is the same path Vim takes for CTRL-X CTRL-O.
+ silent! call python3complete#Complete(0, '')
+
+ call assert_false(filereadable(a:marker_path),
+ \ a:msg . ' (marker ' . a:marker_path . ' was created)')
+
+ bwipe!
+ call delete(a:marker_path)
+endfunc
+
+func Test_python3complete_no_exec_via_class_docstring()
+ " A class-body docstring is emitted verbatim between triple quotes by
+ " get_code() and runs at class-definition time during exec(). A single-
+ " quoted source docstring lets an embedded """ survive doc()'s leading/
+ " trailing quote strip and break out of the generated literal.
+ let marker = tempname()
+ call s:CompleteAndExpectNoMarker([
+ \ 'class Foo:',
+ \ ' ''x"""+open("' . marker . '", "w").close()+"""y''',
+ \ ' pass',
+ \ 'Foo.',
+ \ ], marker,
+ \ 'class docstring expression was evaluated during omni-completion')
+endfunc
+
+" vim: shiftwidth=2 sts=2 expandtab

14
vim.spec
View File

@ -27,7 +27,7 @@ Summary: The VIM editor
URL: http://www.vim.org/
Name: vim
Version: %{baseversion}.%{patchlevel}
Release: 37%{?dist}
Release: 38%{?dist}
License: Vim and MIT
Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
Source1: virc
@ -226,6 +226,13 @@ Patch3076: 0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch
# https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7
# adjusted: stripped src/version.c hunks; replaced mkdir 'pR' flag with 'p' + manual cleanup for Vim 8.2 compat
Patch3077: 0001-patch-9.2.0653-security-out-of-bounds-write-in-tree_.patch
# RHEL-192114 CVE-2026-57456 vim: possible code execution with python complete
# https://redhat.atlassian.net/browse/RHEL-192114
# https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8
# adjusted: stripped src/version.c hunk, stripped "Last Updated" comment noise,
# adapted test for Vim 8.2 (added source check.vim, replaced defer with manual cleanup),
# kept self.params instead of upstream safe_params (prior hardening commit not present)
Patch3078: 0001-patch-9.2.0699-security-possible-code-execution-with.patch
# gcc is no longer in buildroot by default
@ -491,6 +498,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
%patch -P 3075 -p1 -b .phpcomplete-cmd-exec
%patch -P 3076 -p1 -b .soundfold-overflow
%patch -P 3077 -p1 -b .tree-count-words-oob
%patch -P 3078 -p1 -b .python-complete-repr
%build
cd src
@ -1043,6 +1051,10 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
%endif
%changelog
* Thu Jul 30 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.2.2637-38
- RHEL-192114 CVE-2026-57456 vim: possible code execution with python
complete
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.2.2637-37
- RHEL-194065 CVE-2026-55693 vim: out-of-bounds write in
tree_count_words()