Backport two upstream commits to fix CVE-2026-52858, which
allowed arbitrary code execution via python3complete and
pythoncomplete omni-completion plugins.
Patch 9.2.0561 disables execution of import/from statements
in the Python completion plugins by default, adding a
g:pythoncomplete_allow_import opt-in variable for users who
trust their buffer contents.
Patch 9.2.0568 is a follow-up fix that re-imports the vim
module inside evalsource() so the opt-in variable check
works correctly.
CVE: CVE-2026-52858
Upstream patches:
- 4b850457e1.patch
- 868ad62cb8.patch
Resolves: RHEL-186649
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream patch 9.2.0495 (commit f08ab2f4d7d2) to fix
CVE-2026-47162 — code injection via NetrwBookHistSave() in the
netrw plugin.
The vulnerable setline() call in s:NetrwBookHistSave() used naive
string concatenation to build Vimscript let statements, allowing
code injection through crafted directory names. The fix replaces
this with string() for proper quoting.
The patch was adjusted for the RHEL 9 Vim 8.2 codebase: netrw
path changed from runtime/pack/dist/opt/netrw/autoload/ to
runtime/autoload/, and a new test file was added.
CVE: CVE-2026-47162
Upstream patches:
- f08ab2f4d7.patch
Resolves: RHEL-186655
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit cce141c42740 (patch 9.2.0699) to fix a
security vulnerability where crafted docstrings could lead to
arbitrary code execution during Python omni-completion.
The fix replaces triple-quoted string insertion with repr() in
Scope.get_code(), Function.get_code(), and Class.get_code() in
both python3complete.vim and pythoncomplete.vim. A new test file
is included to verify the fix.
CVE: CVE-2026-57456
Upstream patches:
- cce141c427.patch
Resolves: RHEL-192114
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit a80874d9b84a to fix CVE-2026-55693,
an out-of-bounds write in tree_count_words() triggered by
crafted spell files. The patch adds depth bounds checks to
tree_count_words() and sug_filltree() in src/spellfile.c,
preventing writes past the MAXWLEN-sized depth arrays. A
test case is included. The mkdir 'R' flag was adapted for
Vim 8.2 compatibility.
CVE: CVE-2026-55693
Upstream patches:
- a80874d9b8.patch
Resolves: RHEL-194065
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 497f931f to fix CVE-2026-57455, an
out-of-bounds write in spell_soundfold_sofo(). The fix adds
a bounds check (ri < MAXWLEN - 1) to the copy loop so that
input longer than MAXWLEN cannot overflow the stack buffer.
The test was adapted for Vim 8.2 compatibility by replacing
defer/writefile 'D' flag with explicit call delete() at
function end.
CVE: CVE-2026-57455
Upstream patches:
- 497f931f85.patch
Resolves: RHEL-191362
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream patch 9.2.0736 (commit 43afc581) to fix
CVE-2026-59856 — potential arbitrary command execution via
crafted class names in PHP omni-completion.
The fix modifies runtime/autoload/phpcomplete.vim to properly
escape the class name with string() before inserting it into
the search() pattern run via win_execute(). Includes new test
file test_plugin_phpcomplete.vim with regression tests. The
Make_all.mak hunk was adapted for Vim 8.2's test list layout.
CVE: CVE-2026-59856
Upstream patches:
- 43afc581a3.patch
Resolves: RHEL-201196
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream patch fixing CVE-2026-59858, where a
crafted tags file could execute arbitrary Ex commands during
C omni-completion (struct/union member completion via
ccomplete.vim).
Patch 1 (upstream 6b611b0d) escapes the typeref field with
escape(typename, '/\') before interpolating it into the
:vimgrep pattern.
Patch is adapted to the legacy Vimscript style used
in the RHEL 8.2 codebase. A new test file
test_plugin_ccomplete.vim is added covering both injection
vectors and normal typeref completion.
CVE: CVE-2026-59858
Upstream patches:
- 6b611b0d15.patch
Resolves: RHEL-203984
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
