Описание
Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with +ruby support. Step-definition patterns read from .rb files under the repository's features// or stories// directories are embedded into a Ruby Kernel.eval argument without sufficient escaping, allowing a crafted pattern in an attacker-controlled repository to execute arbitrary Ruby (and through it arbitrary shell commands) when the user invokes a step-jump mapping ([d, ]d). This issue has been patched in version 9.2.0496.
A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition patterns. If a user opens this repository and triggers a specific function, the crafted patterns are unsafely processed, potentially allowing the attacker to execute unauthorized commands on the user's system.
Отчет
This Important vulnerability in Vim's cucumber filetype plugin, when configured with Ruby support, allows for arbitrary code execution. An attacker could exploit this by convincing a user to open a specially crafted repository and trigger a specific step-jump mapping, leading to local command execution. This risk is contingent on user interaction with untrusted content and the presence of the Ruby-enabled cucumber plugin.
Меры по смягчению последствий
To mitigate this issue, users should exercise caution when opening untrusted files or repositories with Vim, particularly those that might trigger the cucumber filetype plugin. Avoiding interaction with untrusted content can prevent the execution of malicious step-definition patterns.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | vim | Affected | ||
| Red Hat Enterprise Linux 7 | vim | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat Enterprise Linux 10 | vim | Fixed | RHSA-2026:38509 | 13.07.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | vim | Fixed | RHSA-2026:55431 | 17.08.2026 |
| Red Hat Enterprise Linux 8 | vim | Fixed | RHSA-2026:38510 | 13.07.2026 |
| Red Hat Enterprise Linux 8 | vim | Fixed | RHSA-2026:38510 | 13.07.2026 |
| Red Hat Enterprise Linux 9 | vim | Fixed | RHSA-2026:38511 | 13.07.2026 |
| Red Hat Enterprise Linux 9 | vim | Fixed | RHSA-2026:38511 | 13.07.2026 |
| Red Hat OpenShift Container Platform 4.22 | rhcos-4.22.9.8.202608130832 | Fixed | RHSA-2026:54769 | 18.08.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
7.3 High
CVSS3
Связанные уязвимости
Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with +ruby support. Step-definition patterns read from .rb files under the repository's features/*/ or stories/*/ directories are embedded into a Ruby Kernel.eval argument without sufficient escaping, allowing a crafted pattern in an attacker-controlled repository to execute arbitrary Ruby (and through it arbitrary shell commands) when the user invokes a step-jump mapping ([d, ]d). This issue has been patched in version 9.2.0496.
Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with +ruby support. Step-definition patterns read from .rb files under the repository's features/*/ or stories/*/ directories are embedded into a Ruby Kernel.eval argument without sufficient escaping, allowing a crafted pattern in an attacker-controlled repository to execute arbitrary Ruby (and through it arbitrary shell commands) when the user invokes a step-jump mapping ([d, ]d). This issue has been patched in version 9.2.0496.
Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex
Vim is an open source, command line text editor. Prior to version 9.2. ...
7.3 High
CVSS3