{"id":"CLSA-2026-1782294876","summary":"Fix CVE(s): CVE-2026-52858, CVE-2026-52860","details":"   * SECURITY UPDATE: arbitrary code execution in the python and python3\n     omni-completion plugins: Completer.evalsource() executed import and\n     from statements harvested from the current buffer through Python's\n     import machinery, and because the buffer's directory is on sys.path,\n     opening a hostile .py file alongside a sibling package ran attacker\n     controlled code on omni-completion.\n     - debian/patches/CVE-2026-52858.patch: skip execution of buffer\n       level import/from statements unless the user opts in by setting\n       g:pythoncomplete_allow_import, and re-import the vim module inside\n       evalsource() so the opt-in is honoured, in\n       runtime/autoload/python3complete.vim and\n       runtime/autoload/pythoncomplete.vim; matches upstream patches\n       9.2.0561 and 9.2.0568.\n     - CVE-2026-52858\n   * SECURITY UPDATE: arbitrary code execution in the python and python3\n     omni-completion plugins: the completion code reconstructed function\n     and class definitions from the current buffer and ran them through\n     exec(), and because Python evaluates parameter default values,\n     parameter annotations and class base expressions at definition time,\n     a hostile buffer could execute attacker controlled expressions via\n     crafted def/class headers; the g:pythoncomplete_allow_import\n     mitigation did not cover this path.\n     - debian/patches/CVE-2026-52860.patch: strip default values and\n       annotations from reconstructed function parameter lists and\n       whitelist class base lists to dotted names before the generated\n       source reaches exec(), in runtime/autoload/python3complete.vim and\n       runtime/autoload/pythoncomplete.vim; matches upstream patch\n       9.2.0597.\n     - CVE-2026-52860","modified":"2026-10-26T09:32:01.712542713Z","published":"2026-06-24T09:54:56Z","upstream":["CVE-2026-52858","CVE-2026-52860"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1782294876.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52858"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52860"}],"affected":[{"package":{"name":"vim","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/vim?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els69"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"}},{"package":{"name":"vim-athena","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/vim-athena?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els69"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"}},{"package":{"name":"vim-athena-py2","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/vim-athena-py2?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els69"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"}},{"package":{"name":"vim-common","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/vim-common?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els69"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"}},{"package":{"name":"vim-doc","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/vim-doc?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els69"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"}},{"package":{"name":"vim-gnome","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/vim-gnome?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els69"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"}},{"package":{"name":"vim-gnome-py2","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/vim-gnome-py2?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els69"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"}},{"package":{"name":"vim-gtk","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/vim-gtk?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els69"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"}},{"package":{"name":"vim-gtk-py2","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/vim-gtk-py2?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els69"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"}},{"package":{"name":"vim-gtk3","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/vim-gtk3?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els69"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"}},{"package":{"name":"vim-gtk3-py2","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/vim-gtk3-py2?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els69"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"}},{"package":{"name":"vim-gui-common","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/vim-gui-common?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els69"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"}},{"package":{"name":"vim-nox","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/vim-nox?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els69"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"}},{"package":{"name":"vim-nox-py2","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/vim-nox-py2?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els69"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"}},{"package":{"name":"vim-runtime","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/vim-runtime?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els69"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"}},{"package":{"name":"vim-tiny","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/vim-tiny?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els69"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1782294876.json"}}],"schema_version":"1.9.0"}