Backport two upstream commits to fix CVE-2026-52858, which
allowed arbitrary code execution via python3complete and
pythoncomplete omni-completion plugins.
Patch 9.2.0561 disables execution of import/from statements
in the Python completion plugins by default, adding a
g:pythoncomplete_allow_import opt-in variable for users who
trust their buffer contents.
Patch 9.2.0568 is a follow-up fix that re-imports the vim
module inside evalsource() so the opt-in variable check
works correctly.
CVE: CVE-2026-52858
Upstream patches:
- 4b850457e1.patch
- 868ad62cb8.patch
Resolves: RHEL-186649
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
