CVE Explorer

CVE-2026-47167

Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with +ruby support. Step-definition patterns read from .rb files under the repository's features/*/ or stories/*/ directories are embedded into a Ruby Kernel.eval argument without sufficient escaping, allowing a crafted pattern in an attacker-controlled repository to execute arbitrary Ruby

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:48a16a080f02b27960af36d6a71b44eb8b3e36bd978d5a8790b0249fc6fe7522

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-94","description":"CWE-94: Improper Control of Generation of Code ('Code Injection')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:94988d293342f4db4690d7557c4687665269a9f61bbb005a577fec08a7003b99 · sha256:84a4e07882d49719… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-95","description":"CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:94988d293342f4db4690d7557c4687665269a9f61bbb005a577fec08a7003b99 · sha256:84a4e07882d49719… · /containers/cna/problemTypes/1/descriptions/0

Affected products and versions

1 source assertion

{"product":"vim","vendor":"vim","versions":[{"status":"affected","version":"< 9.2.0496"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:94988d293342f4db4690d7557c4687665269a9f61bbb005a577fec08a7003b99 · sha256:84a4e07882d49719… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW"},"metric_type":"cvssV4_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:94988d293342f4db4690d7557c4687665269a9f61bbb005a577fec08a7003b99 · sha256:84a4e07882d49719… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

2 source assertions

{"cweId":"CWE-94","description":"CWE-94: Improper Control of Generation of Code ('Code Injection')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:94988d293342f4db4690d7557c4687665269a9f61bbb005a577fec08a7003b99 · sha256:84a4e07882d49719… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-95","description":"CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:94988d293342f4db4690d7557c4687665269a9f61bbb005a577fec08a7003b99 · sha256:84a4e07882d49719… · /containers/cna/problemTypes/1/descriptions/0

Source references

3 source assertions

{"name":"https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934","tags":["x_refsource_MISC"],"url":"https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:94988d293342f4db4690d7557c4687665269a9f61bbb005a577fec08a7003b99 · sha256:84a4e07882d49719… · /containers/cna/references/1

{"name":"https://github.com/vim/vim/releases/tag/v9.2.0496","tags":["x_refsource_MISC"],"url":"https://github.com/vim/vim/releases/tag/v9.2.0496"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:94988d293342f4db4690d7557c4687665269a9f61bbb005a577fec08a7003b99 · sha256:84a4e07882d49719… · /containers/cna/references/2

{"name":"https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9","tags":["x_refsource_CONFIRM"],"url":"https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:94988d293342f4db4690d7557c4687665269a9f61bbb005a577fec08a7003b99 · sha256:84a4e07882d49719… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer