SB2026101303 - Eval Injection in Vim

Description

This security bulletin contains information about 1 vulnerability.

1) Eval Injection (CVE-ID: N/A)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary Ruby code and operating-system commands in the context of the user running Vim.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in runtime/autoload/rubycomplete.vim when evaluating buffer-derived variable types during Ruby omni-completion. A remote attacker can trick the victim into opening a crafted Ruby file containing an expression where a class name is expected and invoking omni-completion to execute arbitrary Ruby code and operating-system commands.

Exploitation requires Vim to be built with the Ruby interface (+ruby or +ruby/dyn) and filetype plugins to be enabled. The vulnerable code path is reachable in the default configuration regardless of the g:rubycomplete_buffer_loading setting. Opening the file alone does not trigger exploitation.

Remediation

Install update from vendor's website.

References

• https://github.com/vim/vim/security/advisories/GHSA-4xgr-vqh2-xfx8
• https://github.com/vim/vim/commit/05d704d2856dbb75e95bd33cf222c2e6264fff8b