Backport two upstream commits to fix CVE-2026-52858, which
allowed possible code execution via import/from statements in
python3complete and pythoncomplete omni-completion plugins.
Patch 9.2.0561 disables execution of import/from statements
by default and adds a g:pythoncomplete_allow_import opt-in
variable. Patch 9.2.0568 fixes a bug where the vim module
was not imported in evalsource() scope, causing the opt-in
variable to silently have no effect.
CVE: CVE-2026-52858
Upstream patches:
- 4b850457e1.patch
- 868ad62cb8.patch
Resolves: RHEL-186651
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
