CVE-2026-47167: Vim Cucumber Plugin Code Injection via Unsafe Ruby Eval

Technical summary

The s:stepmatch() function in runtime/ftplugin/cucumber.vim fails to properly escape step-definition patterns before embedding them into a Ruby Kernel.eval() call. The plugin reads .rb files from features/* and stories/* directories within a repository and constructs dynamic Ruby code that is evaluated without sanitization. An attacker who controls repository content can inject arbitrary Ruby expressions that execute with the privileges of the user running Vim. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code) and CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code). This affects Vim builds compiled with the +ruby configuration option prior to version 9.2.0496.

Business impact

For organizations where developers regularly clone and open untrusted or third-party repositories in Vim, this vulnerability creates a supply-chain risk. A malicious contribution to a repository's test fixtures could compromise a developer's machine, potentially leading to theft of source code, credentials, or lateral movement into internal networks. Teams using Vim as their primary editor for Rails or Cucumber-based projects face elevated exposure. However, the attack requires both repository access and active user interaction with a specific Vim mapping, limiting the scope of automated exploitation.

Affected systems

Vim versions prior to 9.2.0496 with +ruby support enabled are affected. This typically includes Vim installations on Linux, macOS, and other Unix-like systems where Ruby development libraries were available at build time. Windows Vim builds with Ruby support are also affected. Users who build Vim without Ruby support or who do not use the Cucumber filetype plugin are not vulnerable. Organizations should verify their Vim build configuration by running :version in Vim and checking for +ruby in the feature list.

Exploitability

Exploitation requires local system access and user interaction. The attacker must ensure a victim opens a repository containing a malicious .rb file in features/ or stories/, then the user must invoke the step-jump mapping ([d or ]d). While these conditions are not trivial, they align with common developer workflows when reviewing external pull requests or exploring unfamiliar codebases. The vulnerability is not remotely exploitable and does not require elevated privileges. No public exploit code has been widely distributed, but the attack surface—Ruby's Kernel.eval() on unsanitized input—is straightforward to weaponize.

Remediation

Update Vim to version 9.2.0496 or later. Users unable to immediately upgrade should disable the Cucumber filetype plugin by removing or renaming runtime/ftplugin/cucumber.vim, or build Vim without Ruby support (--without-ruby during compilation). Teams should review Vim configuration in development environments and consider enforcing a minimum Vim version in developer onboarding documentation. For high-risk teams handling sensitive repositories, consider sandboxing repository inspection in isolated virtual machines or using dedicated, minimally-configured review environments.

Patch guidance

Verify the installed Vim version via :version in the editor or vim --version on the command line. Confirm that the build includes +ruby support. Download or build Vim 9.2.0496 or later from the official Vim repository or pre-built packages provided by your Linux distribution. Test the patch in a non-production environment before rolling out organization-wide to ensure no local customizations are broken. For teams using package managers (apt, brew, yum, etc.), check that distribution repositories have released the patched version; some distributions may lag behind the upstream release.

Detection guidance

Monitor for unexpected Ruby process execution spawned by Vim, particularly when users access repositories with Cucumber test suites. Review audit logs for Kernel.eval calls or unusual shell command execution originating from Vim processes. Implement file integrity monitoring on ftplugin/cucumber.vim to detect unauthorized modifications. For developer endpoints, consider behavioral detection rules that flag Vim launching shell commands or accessing credentials when editing untrusted repositories. Note that legitimate Cucumber workflows may execute Ruby code, so correlation with user intent and repository origin is important.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The CVSS score of 5.3 (Medium) reflects the local-only nature and requirement for user interaction. However, for teams with high repository churn, frequent code review workflows, or developers regularly examining third-party projects, the practical risk is elevated. The flaw exploits a common developer practice—opening external repositories—and touches infrastructure (development machines) that often have access to sensitive assets. Prioritize patching for teams working with open-source contributions or diverse codebases; teams in air-gapped environments or those who rarely review external code can deprioritize slightly.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects: (AV:L) local attack vector—no remote exploitation; (AC:L) low attack complexity—once a malicious repo is opened, triggering the flaw is straightforward; (PR:N) no privileges required; (UI:R) user interaction is required to invoke the step-jump mapping; and (S:U/C:L/I:L/A:L) impact is confined to the local user's confidentiality, integrity, and availability. The score appropriately penalizes the local requirement but acknowledges that a compromised development machine is a serious concern for most organizations.

Frequently asked questions