Eval Injection in Vim - #VU154175

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary Ruby code and operating-system commands in the context of the user running Vim.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in runtime/autoload/rubycomplete.vim when evaluating buffer-derived variable types during Ruby omni-completion. A remote attacker can trick the victim into opening a crafted Ruby file containing an expression where a class name is expected and invoking omni-completion to execute arbitrary Ruby code and operating-system commands.

Exploitation requires Vim to be built with the Ruby interface (+ruby or +ruby/dyn) and filetype plugins to be enabled. The vulnerable code path is reachable in the default configuration regardless of the g:rubycomplete_buffer_loading setting. Opening the file alone does not trigger exploitation.

Affected software

Remediation

External References

• https://github.com/vim/vim/security/advisories/GHSA-4xgr-vqh2-xfx8
• https://github.com/vim/vim/commit/05d704d2856dbb75e95bd33cf222c2e6264fff8b

Related Security Bulletins

• Eval Injection in Vim