CVE-2026-47167

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0496

Description A code injection issue exists in the s:stepmatch() function within the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) for builds with +ruby support. Step-definition patterns read from .rb files in the features/*/ or stories/*/ directories are embedded into a Ruby Kernel.eval argument without sufficient escaping. This allows a crafted pattern in an attacker-controlled repository to execute arbitrary Ruby code and shell commands when a user invokes a step-jump mapping ([d, ]d).

Recommendations Update to version 9.2.0496.