Backport upstream commit 43afc581a37a to fix CVE-2026-59856,
a potential arbitrary command execution vulnerability in the
PHP omni-completion plugin. The fix uses string() for safe
quoting of the class name before inserting it into the
search() pattern run via win_execute() in phpcomplete.vim,
preventing command injection via crafted PHP files. A new
test file (test_plugin_phpcomplete.vim) verifies the fix.
CVE: CVE-2026-59856
Upstream patches:
- 43afc581a3.patch
Resolves: RHEL-201124
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
