CLSA-2026-1782294876
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1782294876
- Upstream
CVE (2)
- Published
- 2026-06-24T09:54:56Z
- Modified
- 2026-10-26T09:32:01Z
- Summary
- Fix CVE(s): CVE-2026-52858, CVE-2026-52860
- Details
-
- SECURITY UPDATE: arbitrary code execution in the python and python3
omni-completion plugins: Completer.evalsource() executed import and
from statements harvested from the current buffer through Python's
import machinery, and because the buffer's directory is on sys.path,
opening a hostile .py file alongside a sibling package ran attacker
controlled code on omni-completion.
- debian/patches/CVE-2026-52858.patch: skip execution of buffer level import/from statements unless the user opts in by setting g:pythoncomplete_allow_import, and re-import the vim module inside evalsource() so the opt-in is honoured, in runtime/autoload/python3complete.vim and runtime/autoload/pythoncomplete.vim; matches upstream patches 9.2.0561 and 9.2.0568.
- CVE-2026-52858
- SECURITY UPDATE: arbitrary code execution in the python and python3
omni-completion plugins: the completion code reconstructed function
and class definitions from the current buffer and ran them through
exec(), and because Python evaluates parameter default values,
parameter annotations and class base expressions at definition time,
a hostile buffer could execute attacker controlled expressions via
crafted def/class headers; the g:pythoncomplete_allow_import
mitigation did not cover this path.
- debian/patches/CVE-2026-52860.patch: strip default values and annotations from reconstructed function parameter lists and whitelist class base lists to dotted names before the generated source reaches exec(), in runtime/autoload/python3complete.vim and runtime/autoload/pythoncomplete.vim; matches upstream patch 9.2.0597.
- CVE-2026-52860
- SECURITY UPDATE: arbitrary code execution in the python and python3
omni-completion plugins: Completer.evalsource() executed import and
from statements harvested from the current buffer through Python's
import machinery, and because the buffer's directory is on sys.path,
opening a hostile .py file alongside a sibling package ran attacker
controlled code on omni-completion.
- References