Eval Injection in Vim - CVE-2026-47167

Vulnerability identifier: #VU131626

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-47167

CWE-ID: CWE-95

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in s:stepmatch() in the cucumber filetype plugin when processing crafted step-definition regex patterns from repository .rb files during step-jump handling. A remote attacker can place a specially crafted step-definition pattern in an attacker-controlled repository to execute arbitrary code.

Exploitation requires a Vim build with +ruby support and user interaction to invoke a step-jump mapping on a matching feature line.

Vim
Red Hat Enterprise Linux Server - AUS
Ubuntu
openEuler
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
vim (Ubuntu package)
vim (Red Hat package)
vim-X11
vim
vim-common
vim-debuginfo
vim-debugsource
vim-enhanced
vim-minimal
vim-filesystem

Install security update from vendor's website.

Vim - update to 9.2.0496
vim (Ubuntu package) - addressed in versions 2:7.4.052-1ubuntu3.1+esm29, 2:7.4.1689-3ubuntu1.5+esm35, 2:8.0.1453-1ubuntu1.13+esm20, 2:8.1.2269-1ubuntu5.32+esm8, 2:8.2.3995-1ubuntu2.32, 2:9.1.0016-1ubuntu7.16, 2:9.1.0967-1ubuntu6.7, 2:9.1.2141-1ubuntu4.5
vim (Red Hat package) - addressed in versions 7.4.629-5.el6_10.4, 7.4.629-8.el7_9.2, 8.2.2637-20.el9_2.3, 8.2.2637-20.el9_4.4
vim-X11 - addressed in versions 9.0-50, 9.0.2092-36
vim - addressed in versions 9.0-50, 9.0.2092-36
vim-common - addressed in versions 9.0-50, 9.0.2092-36
vim-debuginfo - addressed in versions 9.0-50, 9.0.2092-36
vim-debugsource - addressed in versions 9.0-50, 9.0.2092-36
vim-enhanced - addressed in versions 9.0-50, 9.0.2092-36
vim-minimal - addressed in versions 9.0-50, 9.0.2092-36
vim-filesystem - addressed in versions 9.0-50, 9.0.2092-36

• https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9
• https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934

• Eval Injection in Vim
• Ubuntu update for vim
• openEuler 24.03 LTS SP3 update for vim
• openEuler 24.03 LTS SP1 update for vim
• openEuler 22.03 LTS SP4 update for vim
• openEuler 20.03 LTS SP4 update for vim
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for vim
• Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION update for vim
• Red Hat Enterprise Linux 9 update for vim
• Red Hat Enterprise Linux 9 update for vim