Vim < 9.2.0597 Code Execution (GHSA-65p9-mwwx-7468)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(321505);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/18");

  script_cve_id("CVE-2026-52860");

  script_name(english:"Vim < 9.2.0597 Code Execution (GHSA-65p9-mwwx-7468)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Vim installed on the remote host is prior to 9.2.0597. It is, therefore, affected by a vulnerability
as referenced in the GHSA-65p9-mwwx-7468 advisory.

  - Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer
    with exec() as part of populating the completion dictionary. Python evaluates function default values,
    parameter annotations, and class base expressions at definition time, so a hostile buffer can execute
    attacker-controlled Python expressions during omni-completion. The existing
    g:pythoncomplete_allow_import mitigation (GHSA-52mc-rq6p-rc7c) does not cover this path, because the
    attacker-controlled code is not a harvested import/from statement. (CVE-2026-52860)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?48a0166c");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Vim version 9.2.0597 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-52860");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vim:vim");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("vim_win_installed.nbin", "vim_nix_installed.nbin");
  script_require_keys("installed_sw/Vim");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Vim', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
        { 'fixed_version' : '9.2.0597' }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);