new file mode 100644
@@ -0,0 +1,94 @@
+From 8075209bb1e721ca89c2e7fd5d216d7fe2bd3ea6 Mon Sep 17 00:00:00 2001
+From: thinca <thinca@gmail.com>
+Date: Sun, 31 May 2026 12:33:07 +0000
+Subject: [PATCH] patch 9.2.0568: pythoncomplete: g:pythoncomplete_allow_import
+ had no effect
+
+Problem: The security patch 9.2.0561 added a vim.eval() call inside
+ Completer.evalsource() to honor g:pythoncomplete_allow_import.
+ But the 'vim' module is only imported inside the outer
+ vimcomplete() / vimpy3complete() function, not at the script's
+ top level, so referring to it from a Completer method raises
+ NameError. The surrounding bare 'except' silently swallows
+ the error and leaves allow_imports at 0, meaning the opt-in
+ never takes effect -- 'import os' (and any other
+ buffer-level import) is always skipped, no candidates are
+ produced for 'os.<...>' and
+ Test_popup_and_preview_autocommand() fails on the Windows
+ CI matrix (Linux skips the test because Python 2 is absent).
+Solution: Re-import 'vim' at the top of evalsource() in both
+ pythoncomplete.vim and python3complete.vim so the eval reads
+ the global, and set g:pythoncomplete_allow_import = 1 in the
+ test (it is the opt-in intended for callers that trust the
+ buffer contents) (thinca).
+
+closes: #20386
+
+CVE: CVE-2026-52858
+Upstream-Status: Backport [https://github.com/vim/vim/commit/868ad62cb8bf8038322eab2badd31bd98b02b9df]
+
+Backport Changes:
+- Omitted src/version.c because the Scarthgap recipe remains at Vim 9.1.1683;
+ the upstream version-table hunk targets Vim 9.2 and conflicted during
+ cherry-pick, while the runtime and test changes applied unchanged.
+
+Signed-off-by: thinca <thinca@gmail.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+(cherry picked from commit 868ad62cb8bf8038322eab2badd31bd98b02b9df)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ runtime/autoload/python3complete.vim | 3 +++
+ runtime/autoload/pythoncomplete.vim | 3 +++
+ src/testdir/test_popup.vim | 4 ++++
+ 3 files changed, 10 insertions(+)
+
+diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim
+index a0314242b..bdabf62c8 100644
+--- a/runtime/autoload/python3complete.vim
++++ b/runtime/autoload/python3complete.vim
+@@ -158,6 +158,9 @@ class Completer(object):
+ self.parser = PyParser()
+
+ def evalsource(self,text,line=0):
++ # vim is imported locally in vimpy3complete(); re-import here so the
++ # vim.eval() below works (otherwise NameError, silently caught).
++ import vim
+ sc = self.parser.parse(text,line)
+ try: allow_imports = int(
+ vim.eval("get(g:, 'pythoncomplete_allow_import', 0)"))
+diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim
+index 39b1efd29..761488244 100644
+--- a/runtime/autoload/pythoncomplete.vim
++++ b/runtime/autoload/pythoncomplete.vim
+@@ -172,6 +172,9 @@ class Completer(object):
+ self.parser = PyParser()
+
+ def evalsource(self,text,line=0):
++ # vim is imported locally in vimcomplete(); re-import here so the
++ # vim.eval() below works (otherwise NameError, silently caught).
++ import vim
+ sc = self.parser.parse(text,line)
+ try: allow_imports = int(
+ vim.eval("get(g:, 'pythoncomplete_allow_import', 0)"))
+diff --git a/src/testdir/test_popup.vim b/src/testdir/test_popup.vim
+index fac2a7592..55c2f232d 100644
+--- a/src/testdir/test_popup.vim
++++ b/src/testdir/test_popup.vim
+@@ -723,6 +723,9 @@ func Test_popup_and_preview_autocommand()
+ au!
+ au BufAdd * nested tab sball
+ augroup END
++ " Let pythoncomplete follow the buffer's 'import os' (off by default
++ " since v9.2.0561) so 'os.' can be completed.
++ let g:pythoncomplete_allow_import = 1
+ set omnifunc=pythoncomplete#Complete
+ call setline(1, 'import os')
+ " make the line long
+@@ -745,6 +748,7 @@ func Test_popup_and_preview_autocommand()
+ augroup END
+ augroup! MyBufAdd
+ bw!
++ unlet g:pythoncomplete_allow_import
+ endfunc
+
+ func s:run_popup_and_previewwindow_dump(lines, dumpfile)
@@ -34,6 +34,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
file://CVE-2026-46483.patch \
file://CVE-2026-28420.patch \
file://CVE-2026-52858.patch \
+ file://CVE-2026-52858-regression.patch \
file://CVE-2026-52859.patch \
file://CVE-2026-52860.patch \
file://CVE-2026-28422.patch \