CLSA-2026-1789136288 Fix CVE(s): CVE-2026-73073

SECURITY UPDATE: Arbitrary Ex command execution during C omni-completion: s:StructMembers in runtime/autoload/ccomplete.vim interpolates a tags-file typeref/typename value into a :vimgrep pattern with only "/" and "" escaped, so an unclosed "" makes vimgrep pattern skipping fail and a following...

CLSA-2026-1788182469 Fix CVE(s): CVE-2026-73073

SECURITY UPDATE: arbitrary Ex command execution during C omni-completion: escaping only "/" and "\" in the typeref/typename tag field was not enough. With no "/" in the payload an unclosed "" makes :vimgrep's pattern skipping fail, after which the command parser treats a following "|" as a comman...

CLSA-2026-1786353169 vim: Fix of CVE-2026-59858

CVE-2026-59858: escape the typeref/typename tags field before interpolating it into the :vimgrep pattern in ccomplete.vim s:StructMembers, preventing arbitrary Ex command execution during C omni-completion upstream 9.2.0735...

CLSA-2026-1784807557 vim: Fix of CVE-2026-59858

CVE-2026-59858: escape the typeref/typename tags field before interpolating it into the :vimgrep pattern in ccomplete.vim s:StructMembers, preventing arbitrary Ex command execution during C omni-completion upstream 9.2.0735...

CLSA-2026-1784799711 Fix CVE(s): CVE-2026-59858

SECURITY UPDATE: arbitrary Ex command execution during C omni-completion: the C omni-completion script interpolated the typeref/typename tag field of a tags entry, without escaping, into a :vimgrep pattern run through :execute. Because :vimgrep honours the bar as a command separator, a crafted ta...