Backport upstream patch 9.2.0736 (commit 43afc581) to fix
CVE-2026-59856 — potential arbitrary command execution via
crafted class names in PHP omni-completion.
The fix modifies runtime/autoload/phpcomplete.vim to properly
escape the class name with string() before inserting it into
the search() pattern run via win_execute(). Includes new test
file test_plugin_phpcomplete.vim with regression tests. The
Make_all.mak hunk was adapted for Vim 8.2's test list layout.
CVE: CVE-2026-59856
Upstream patches:
- 43afc581a3.patch
Resolves: RHEL-201196
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
