[vim-security] Arbitrary Code Execution via Ruby Omni-Completion in Vim < 9.2.1177
Vim before 9.2.1177 allows arbitrary code execution through Ruby omni-completion; no CVE yet.
Christian Brabandt reported a medium-severity arbitrary code execution flaw in Vim versions before 9.2.1177. The Ruby omni-completion script in runtime/autoload/rubycomplete.vim derives a type from buffer content in a way that can lead to code execution. The issue is mapped to CWE-95 and CWE-94. A CVE has been requested but is not yet assigned, with no reported in-the-wild exploitation.
- Affects Vim versions before 9.2.1177 in rubycomplete.vim.
- Ruby omni-completion can allow arbitrary code execution.
- Rated medium; mapped to CWE-94 and CWE-95.
- A CVE was requested but has not yet been assigned.
Posted by Christian Brabandt on Oct 12 Arbitrary Code Execution via Ruby Omni-Completion in Vim < 9.2.1177 =================================================================== Date: 12.10.2026 Severity: Medium CVE: *requested, not yet assigned* CWE: Improper Neutralization of Directives in Dynamically Evaluated Code (CWE-95), Improper Control of Generation of Code (CWE-94) ## Summary The Ruby omni-completion script in `runtime/autoload/rubycomplete.vim` derives the type of a...
This source does not provide full text. Read it at seclists.org.