Executive brief
Vim is a widely used open-source text editor. A security vulnerability in its Cucumber plugin allows an attacker to execute malicious code on a user's computer if the user opens a specially crafted project and uses specific navigation shortcuts. This could lead to full system compromise or unauthorized access to the user's files and data.
Technical details
A code injection vulnerability exists in the `s:stepmatch()` function within Vim's Cucumber filetype plugin (`runtime/ftplugin/cucumber.vim`). When Vim is compiled with Ruby support (`+ruby`), step-definition patterns read from `.rb` files in a repository's `features/` or `stories/` directories are passed to the Ruby `Kernel.eval` method without adequate escaping. An attacker can craft a malicious pattern that terminates the intended regex literal and executes arbitrary Ruby code. Exploitation occurs when a user opens an attacker-controlled repository and triggers a step-jump mapping (e.g., `[d` or `]d`). This allows for arbitrary shell command execution with the privileges of the Vim user. The issue is fixed in version 9.2.0496 by using `Regexp.new()` instead of string concatenation in `eval`.
Affected products
- Vim Vim Prior to 9.2.0496
Timeline
- 2026-05-17: patched: Patch 9.2.0496 released
- 2026-05-17: advisory: GitHub Security Advisory GHSA-4473-94jm-w5x9 published
- 2026-06-11: disclosed: CVE-2026-47167 published to NVD