CVE-2026-47167: Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex
Last updated 19 June 2026
Other sources
Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with +ruby support. Step-definition patterns read from .rb files under the repository's features// or stories// directories are embedded into a Ruby Kernel.eval argument without sufficient escaping, allowing a crafted pattern in an attacker-controlled repository to execute arbitrary Ruby (and through it arbitrary shell commands) when the user invokes a step-jump mapping ([d, ]d). This issue has been patched in version 9.2.0496.
— MITRE
Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.2.0524-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.0620-1 - Upgrade
Upgrade
vimto a version that resolves this vulnerability.Fixed in 9.2.0496
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47167?
CVE-2026-47167 has a medium severity rating of 5.1 according to the CVSS score.
How do I fix CVE-2026-47167?
To fix CVE-2026-47167, upgrade to Vim version 9.2.0496 or later where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-47167?
CVE-2026-47167 is a code injection vulnerability affecting the cucumber filetype plugin in Vim.
Which Vim versions are affected by CVE-2026-47167?
CVE-2026-47167 affects Vim versions prior to 9.2.0496 that are built with +ruby support.
What is the attack vector for CVE-2026-47167?
The attack vector for CVE-2026-47167 is local, as it requires the attacker to have access to the affected Vim installation.