CVE-2026-47167

Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex

CVE-2026-47167 is fixed in 23 products on 1 platform, first by vim 2:9.1.2141-1ubuntu4.5, released June 11, 2026. It is not reported as exploited. Patch Radar priority: High.

High
CVSS
7.3
Moderate
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0014
3rd percentile

Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with +ruby support. Step-definition patterns read from .rb files under the repository's features/*/ or stories/*/ directories are embedded into a Ruby Kernel.eval argument without sufficient escaping, allowing a crafted pattern in an attacker-controlled repository to execute arbitrary Ruby (and through it arbitrary shell commands) when the user invokes a step-jump mapping ([d, ]d). This issue has been patched in version 9.2.0496.

Where it's fixed

ProductFixed inFixReleased
Linux
vim · Debian 13.5 (trixie) 2:9.1.1230-2+deb13u1 DEBIAN-CVE-2026-47167 Jun 24, 2026
vim · Debian 14 2:9.2.0524-1 DEBIAN-CVE-2026-47167 Jun 24, 2026
vim · RHEL 10 9.1.083-5.el10_0.4 RHSA-2026:55431 Aug 1, 2026
vim · Ubuntu 18.04.6 LTS (bionic) 2:8.0.1453-1ubuntu1.13+esm20 vim 2:8.0.1453-1ubuntu1.13+esm20 Jun 24, 2026
vim · Ubuntu 20.04 LTS (focal) 2:8.1.2269-1ubuntu5.32+esm8 vim 2:8.1.2269-1ubuntu5.32+esm8 Jun 24, 2026
vim · Ubuntu 22.04.1 LTS (jammy) 2:8.2.3995-1ubuntu2.32 vim 2:8.2.3995-1ubuntu2.32 Jun 24, 2026
vim · Ubuntu 24.04.5 LTS (noble) 2:9.1.0016-1ubuntu7.16 vim 2:9.1.0016-1ubuntu7.16 Jun 24, 2026
vim · Ubuntu 25.10 (questing) 2:9.1.0967-1ubuntu6.7 vim 2:9.1.0967-1ubuntu6.7 Jun 24, 2026
vim · Ubuntu 26.04.1 LTS (resolute) 2:9.1.2141-1ubuntu4.5 vim 2:9.1.2141-1ubuntu4.5 Jun 11, 2026
vim · rocky 10 2:9.1.083-9.el10_2.7 RLSA-2026:38509 Aug 11, 2026
vim · rocky 8 2:8.0.1763-27.el8_10 RLSA-2026:38510 Aug 11, 2026
vim · rocky 9 2:8.2.2637-26.el9_8.10 RLSA-2026:38511 Aug 11, 2026
vim-X11 · almalinux 10 2:9.1.083-9.el10_2.7 ALSA-2026:38509 Jul 13, 2026
vim-X11 · almalinux 8 2:8.0.1763-27.el8_10 ALSA-2026:38510 Jul 13, 2026
vim-X11 · almalinux 9 2:8.2.2637-26.el9_8.10 ALSA-2026:38511 Jul 13, 2026
vim-X11 · ol 10 2:9.1.083-9.0.1.el10_2.7 ELSA-2026-38509 Jul 16, 2026
vim-X11 · ol 8 2:8.0.1763-27.0.1.el8_10 ELSA-2026-38510 Jul 13, 2026
vim-X11 · ol 9 2:8.2.2637-26.0.1.el9_8.10 ELSA-2026-38511 Jul 14, 2026
vim-athena · Ubuntu 18.04.6 LTS (bionic) 2:8.0.1453-1ubuntu1.13+esm20 vim-athena 2:8.0.1453-1ubuntu1.13+esm20 Jun 24, 2026
vim-athena · Ubuntu 20.04 LTS (focal) 2:8.1.2269-1ubuntu5.32+esm8 vim-athena 2:8.1.2269-1ubuntu5.32+esm8 Jun 24, 2026
vim-athena · Ubuntu 22.04.1 LTS (jammy) 2:8.2.3995-1ubuntu2.32 vim-athena 2:8.2.3995-1ubuntu2.32 Jun 24, 2026
vim-athena · Ubuntu 24.04.5 LTS (noble) 2:9.1.0016-1ubuntu7.16 vim-athena 2:9.1.0016-1ubuntu7.16 Jun 24, 2026
vim-athena · Ubuntu 25.10 (questing) 2:9.1.0967-1ubuntu6.7 vim-athena 2:9.1.0967-1ubuntu6.7 Jun 24, 2026
vim-common · RHEL 8 2:8.0.1763-27.el8_10 RHSA-2026:38510 Aug 10, 2026
vim-common · RHEL 9 2:8.2.2637-26.el9_8.10 RHSA-2026:38511 Aug 10, 2026
vim-common · Ubuntu 18.04.6 LTS (bionic) 2:8.0.1453-1ubuntu1.13+esm20 vim-common 2:8.0.1453-1ubuntu1.13+esm20 Jun 24, 2026
vim-common · Ubuntu 20.04 LTS (focal) 2:8.1.2269-1ubuntu5.32+esm8 vim-common 2:8.1.2269-1ubuntu5.32+esm8 Jun 24, 2026
vim-common · Ubuntu 22.04.1 LTS (jammy) 2:8.2.3995-1ubuntu2.32 vim-common 2:8.2.3995-1ubuntu2.32 Jun 24, 2026
vim-common · Ubuntu 24.04.5 LTS (noble) 2:9.1.0016-1ubuntu7.16 vim-common 2:9.1.0016-1ubuntu7.16 Jun 24, 2026
vim-common · Ubuntu 25.10 (questing) 2:9.1.0967-1ubuntu6.7 vim-common 2:9.1.0967-1ubuntu6.7 Jun 24, 2026
vim-common · Ubuntu 26.04.1 LTS (resolute) 2:9.1.2141-1ubuntu4.5 vim-common 2:9.1.2141-1ubuntu4.5 Jun 11, 2026
vim-common · almalinux 10 2:9.1.083-9.el10_2.7 ALSA-2026:38509 Jul 13, 2026
vim-common · almalinux 8 2:8.0.1763-27.el8_10 ALSA-2026:38510 Jul 13, 2026
vim-common · almalinux 9 2:8.2.2637-26.el9_8.10 ALSA-2026:38511 Jul 13, 2026
vim-common · amzn 2023 2:9.2.597-1.amzn2023.0.1 ALAS2023-2026-1862 Jun 22, 2026
vim-common · ol 10 2:9.1.083-9.0.1.el10_2.7 ELSA-2026-38509 Jul 16, 2026
vim-common · ol 8 2:8.0.1763-27.0.1.el8_10 ELSA-2026-38510 Jul 13, 2026
vim-common · ol 9 2:8.2.2637-26.0.1.el9_8.10 ELSA-2026-38511 Jul 14, 2026
vim-data · almalinux 10 2:9.1.083-9.el10_2.7 ALSA-2026:38509 Jul 13, 2026
vim-data · amzn 2023 2:9.2.597-1.amzn2023.0.1 ALAS2023-2026-1862 Jun 22, 2026
vim-data · ol 10 2:9.1.083-9.0.1.el10_2.7 ELSA-2026-38509 Jul 16, 2026
vim-debuginfo · amzn 2023 2:9.2.597-1.amzn2023.0.1 ALAS2023-2026-1862 Jun 22, 2026
vim-debugsource · amzn 2023 2:9.2.597-1.amzn2023.0.1 ALAS2023-2026-1862 Jun 22, 2026
vim-default-editor · amzn 2023 2:9.2.597-1.amzn2023.0.1 ALAS2023-2026-1862 Jun 22, 2026
vim-enhanced · almalinux 10 2:9.1.083-9.el10_2.7 ALSA-2026:38509 Jul 13, 2026
vim-enhanced · almalinux 8 2:8.0.1763-27.el8_10 ALSA-2026:38510 Jul 13, 2026
vim-enhanced · almalinux 9 2:8.2.2637-26.el9_8.10 ALSA-2026:38511 Jul 13, 2026
vim-enhanced · amzn 2023 2:9.2.597-1.amzn2023.0.1 ALAS2023-2026-1862 Jun 22, 2026
vim-enhanced · ol 10 2:9.1.083-9.0.1.el10_2.7 ELSA-2026-38509 Jul 16, 2026
vim-enhanced · ol 8 2:8.0.1763-27.0.1.el8_10 ELSA-2026-38510 Jul 13, 2026
vim-enhanced · ol 9 2:8.2.2637-26.0.1.el9_8.10 ELSA-2026-38511 Jul 14, 2026
vim-enhanced-debuginfo · amzn 2023 2:9.2.597-1.amzn2023.0.1 ALAS2023-2026-1862 Jun 22, 2026
vim-filesystem · almalinux 10 2:9.1.083-9.el10_2.7 ALSA-2026:38509 Jul 13, 2026
vim-filesystem · almalinux 8 2:8.0.1763-27.el8_10 ALSA-2026:38510 Jul 13, 2026
vim-filesystem · almalinux 9 2:8.2.2637-26.el9_8.10 ALSA-2026:38511 Jul 13, 2026
vim-filesystem · amzn 2023 2:9.2.597-1.amzn2023.0.1 ALAS2023-2026-1862 Jun 22, 2026
vim-filesystem · ol 10 2:9.1.083-9.0.1.el10_2.7 ELSA-2026-38509 Jul 16, 2026
vim-filesystem · ol 8 2:8.0.1763-27.0.1.el8_10 ELSA-2026-38510 Jul 13, 2026
vim-filesystem · ol 9 2:8.2.2637-26.0.1.el9_8.10 ELSA-2026-38511 Jul 14, 2026
vim-gnome · Ubuntu 18.04.6 LTS (bionic) 2:8.0.1453-1ubuntu1.13+esm20 vim-gnome 2:8.0.1453-1ubuntu1.13+esm20 Jun 24, 2026
vim-gtk · Ubuntu 18.04.6 LTS (bionic) 2:8.0.1453-1ubuntu1.13+esm20 vim-gtk 2:8.0.1453-1ubuntu1.13+esm20 Jun 24, 2026
vim-gtk · Ubuntu 20.04 LTS (focal) 2:8.1.2269-1ubuntu5.32+esm8 vim-gtk 2:8.1.2269-1ubuntu5.32+esm8 Jun 24, 2026
vim-gtk · Ubuntu 22.04.1 LTS (jammy) 2:8.2.3995-1ubuntu2.32 vim-gtk 2:8.2.3995-1ubuntu2.32 Jun 24, 2026
vim-gtk3 · Ubuntu 18.04.6 LTS (bionic) 2:8.0.1453-1ubuntu1.13+esm20 vim-gtk3 2:8.0.1453-1ubuntu1.13+esm20 Jun 24, 2026
vim-gtk3 · Ubuntu 20.04 LTS (focal) 2:8.1.2269-1ubuntu5.32+esm8 vim-gtk3 2:8.1.2269-1ubuntu5.32+esm8 Jun 24, 2026
vim-gtk3 · Ubuntu 22.04.1 LTS (jammy) 2:8.2.3995-1ubuntu2.32 vim-gtk3 2:8.2.3995-1ubuntu2.32 Jun 24, 2026
vim-gtk3 · Ubuntu 24.04.5 LTS (noble) 2:9.1.0016-1ubuntu7.16 vim-gtk3 2:9.1.0016-1ubuntu7.16 Jun 24, 2026
vim-gtk3 · Ubuntu 25.10 (questing) 2:9.1.0967-1ubuntu6.7 vim-gtk3 2:9.1.0967-1ubuntu6.7 Jun 24, 2026
vim-gtk3 · Ubuntu 26.04.1 LTS (resolute) 2:9.1.2141-1ubuntu4.5 vim-gtk3 2:9.1.2141-1ubuntu4.5 Jun 11, 2026
vim-gui-common · Ubuntu 18.04.6 LTS (bionic) 2:8.0.1453-1ubuntu1.13+esm20 vim-gui-common 2:8.0.1453-1ubuntu1.13+esm20 Jun 24, 2026
vim-gui-common · Ubuntu 20.04 LTS (focal) 2:8.1.2269-1ubuntu5.32+esm8 vim-gui-common 2:8.1.2269-1ubuntu5.32+esm8 Jun 24, 2026
vim-gui-common · Ubuntu 22.04.1 LTS (jammy) 2:8.2.3995-1ubuntu2.32 vim-gui-common 2:8.2.3995-1ubuntu2.32 Jun 24, 2026
vim-gui-common · Ubuntu 24.04.5 LTS (noble) 2:9.1.0016-1ubuntu7.16 vim-gui-common 2:9.1.0016-1ubuntu7.16 Jun 24, 2026
vim-gui-common · Ubuntu 25.10 (questing) 2:9.1.0967-1ubuntu6.7 vim-gui-common 2:9.1.0967-1ubuntu6.7 Jun 24, 2026
vim-gui-common · Ubuntu 26.04.1 LTS (resolute) 2:9.1.2141-1ubuntu4.5 vim-gui-common 2:9.1.2141-1ubuntu4.5 Jun 11, 2026
vim-minimal · almalinux 10 2:9.1.083-9.el10_2.7 ALSA-2026:38509 Jul 13, 2026
vim-minimal · almalinux 8 2:8.0.1763-27.el8_10 ALSA-2026:38510 Jul 13, 2026
vim-minimal · almalinux 9 2:8.2.2637-26.el9_8.10 ALSA-2026:38511 Jul 13, 2026
vim-minimal · amzn 2023 2:9.2.597-1.amzn2023.0.1 ALAS2023-2026-1862 Jun 22, 2026
vim-minimal · ol 10 2:9.1.083-9.0.1.el10_2.7 ELSA-2026-38509 Jul 16, 2026
vim-minimal · ol 8 2:8.0.1763-27.0.1.el8_10 ELSA-2026-38510 Jul 13, 2026
vim-minimal · ol 9 2:8.2.2637-26.0.1.el9_8.10 ELSA-2026-38511 Jul 14, 2026
vim-minimal-debuginfo · amzn 2023 2:9.2.597-1.amzn2023.0.1 ALAS2023-2026-1862 Jun 22, 2026
vim-motif · Ubuntu 24.04.5 LTS (noble) 2:9.1.0016-1ubuntu7.16 vim-motif 2:9.1.0016-1ubuntu7.16 Jun 24, 2026
vim-motif · Ubuntu 25.10 (questing) 2:9.1.0967-1ubuntu6.7 vim-motif 2:9.1.0967-1ubuntu6.7 Jun 24, 2026
vim-motif · Ubuntu 26.04.1 LTS (resolute) 2:9.1.2141-1ubuntu4.5 vim-motif 2:9.1.2141-1ubuntu4.5 Jun 11, 2026
vim-nox · Ubuntu 18.04.6 LTS (bionic) 2:8.0.1453-1ubuntu1.13+esm20 vim-nox 2:8.0.1453-1ubuntu1.13+esm20 Jun 24, 2026
vim-nox · Ubuntu 20.04 LTS (focal) 2:8.1.2269-1ubuntu5.32+esm8 vim-nox 2:8.1.2269-1ubuntu5.32+esm8 Jun 24, 2026
vim-nox · Ubuntu 22.04.1 LTS (jammy) 2:8.2.3995-1ubuntu2.32 vim-nox 2:8.2.3995-1ubuntu2.32 Jun 24, 2026
vim-nox · Ubuntu 24.04.5 LTS (noble) 2:9.1.0016-1ubuntu7.16 vim-nox 2:9.1.0016-1ubuntu7.16 Jun 24, 2026
vim-nox · Ubuntu 25.10 (questing) 2:9.1.0967-1ubuntu6.7 vim-nox 2:9.1.0967-1ubuntu6.7 Jun 24, 2026
vim-nox · Ubuntu 26.04.1 LTS (resolute) 2:9.1.2141-1ubuntu4.5 vim-nox 2:9.1.2141-1ubuntu4.5 Jun 11, 2026
vim-runtime · Ubuntu 18.04.6 LTS (bionic) 2:8.0.1453-1ubuntu1.13+esm20 vim-runtime 2:8.0.1453-1ubuntu1.13+esm20 Jun 24, 2026
vim-runtime · Ubuntu 20.04 LTS (focal) 2:8.1.2269-1ubuntu5.32+esm8 vim-runtime 2:8.1.2269-1ubuntu5.32+esm8 Jun 24, 2026
vim-runtime · Ubuntu 22.04.1 LTS (jammy) 2:8.2.3995-1ubuntu2.32 vim-runtime 2:8.2.3995-1ubuntu2.32 Jun 24, 2026
vim-runtime · Ubuntu 24.04.5 LTS (noble) 2:9.1.0016-1ubuntu7.16 vim-runtime 2:9.1.0016-1ubuntu7.16 Jun 24, 2026
vim-runtime · Ubuntu 25.10 (questing) 2:9.1.0967-1ubuntu6.7 vim-runtime 2:9.1.0967-1ubuntu6.7 Jun 24, 2026
vim-runtime · Ubuntu 26.04.1 LTS (resolute) 2:9.1.2141-1ubuntu4.5 vim-runtime 2:9.1.2141-1ubuntu4.5 Jun 11, 2026
vim-tiny · Ubuntu 18.04.6 LTS (bionic) 2:8.0.1453-1ubuntu1.13+esm20 vim-tiny 2:8.0.1453-1ubuntu1.13+esm20 Jun 24, 2026
vim-tiny · Ubuntu 20.04 LTS (focal) 2:8.1.2269-1ubuntu5.32+esm8 vim-tiny 2:8.1.2269-1ubuntu5.32+esm8 Jun 24, 2026
vim-tiny · Ubuntu 22.04.1 LTS (jammy) 2:8.2.3995-1ubuntu2.32 vim-tiny 2:8.2.3995-1ubuntu2.32 Jun 24, 2026
vim-tiny · Ubuntu 24.04.5 LTS (noble) 2:9.1.0016-1ubuntu7.16 vim-tiny 2:9.1.0016-1ubuntu7.16 Jun 24, 2026
vim-tiny · Ubuntu 25.10 (questing) 2:9.1.0967-1ubuntu6.7 vim-tiny 2:9.1.0967-1ubuntu6.7 Jun 24, 2026
vim-tiny · Ubuntu 26.04.1 LTS (resolute) 2:9.1.2141-1ubuntu4.5 vim-tiny 2:9.1.2141-1ubuntu4.5 Jun 11, 2026
xxd · Ubuntu 18.04.6 LTS (bionic) 2:8.0.1453-1ubuntu1.13+esm20 xxd 2:8.0.1453-1ubuntu1.13+esm20 Jun 24, 2026
xxd · Ubuntu 20.04 LTS (focal) 2:8.1.2269-1ubuntu5.32+esm8 xxd 2:8.1.2269-1ubuntu5.32+esm8 Jun 24, 2026
xxd · Ubuntu 22.04.1 LTS (jammy) 2:8.2.3995-1ubuntu2.32 xxd 2:8.2.3995-1ubuntu2.32 Jun 24, 2026
xxd · Ubuntu 24.04.5 LTS (noble) 2:9.1.0016-1ubuntu7.16 xxd 2:9.1.0016-1ubuntu7.16 Jun 24, 2026
xxd · Ubuntu 25.10 (questing) 2:9.1.0967-1ubuntu6.7 xxd 2:9.1.0967-1ubuntu6.7 Jun 24, 2026
xxd · Ubuntu 26.04.1 LTS (resolute) 2:9.1.2141-1ubuntu4.5 xxd 2:9.1.2141-1ubuntu4.5 Jun 11, 2026
xxd · almalinux 10 2:9.1.083-9.el10_2.7 ALSA-2026:38509 Jul 13, 2026
xxd · amzn 2023 2:9.2.597-1.amzn2023.0.1 ALAS2023-2026-1862 Jun 22, 2026
xxd · ol 10 2:9.1.083-9.0.1.el10_2.7 ELSA-2026-38509 Jul 16, 2026
xxd-debuginfo · amzn 2023 2:9.2.597-1.amzn2023.0.1 ALAS2023-2026-1862 Jun 22, 2026

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.