From e7e02f6acf325cdf35bc75a56c4dd80e38606ddb Mon Sep 17 00:00:00 2001
From: Zdenek Dohnal <zdohnal@redhat.com>
Date: Thu, 16 Jul 2026 15:32:10 +0200
Subject: [PATCH] CVE-2026-47167 vim: Code Injection in cucumber filetype
 plugin

Resolves: RHEL-185873
---
 ...ecurity-Code-Injection-in-cucumber-f.patch | 73 +++++++++++++++++++
 vim.spec                                      | 10 ++-
 2 files changed, 82 insertions(+), 1 deletion(-)
 create mode 100644 0001-patch-9.2.0496-security-Code-Injection-in-cucumber-f.patch

diff --git a/0001-patch-9.2.0496-security-Code-Injection-in-cucumber-f.patch b/0001-patch-9.2.0496-security-Code-Injection-in-cucumber-f.patch
new file mode 100644
index 00000000..b4e84f35
--- /dev/null
+++ b/0001-patch-9.2.0496-security-Code-Injection-in-cucumber-f.patch
@@ -0,0 +1,73 @@
+diff -up vim82/runtime/ftplugin/cucumber.vim.cucumber-code-inject vim82/runtime/ftplugin/cucumber.vim
+--- vim82/runtime/ftplugin/cucumber.vim.cucumber-code-inject	2021-03-22 10:02:41.000000000 +0100
++++ vim82/runtime/ftplugin/cucumber.vim	2026-06-30 15:35:41.267808950 +0200
+@@ -96,7 +96,8 @@ function! s:stepmatch(receiver,target)
+   catch
+   endtry
+   if has("ruby") && pattern !~ '\\\@<!#{'
+-    ruby VIM.command("return #{if (begin; Kernel.eval('/'+VIM.evaluate('pattern')+'/'); rescue SyntaxError; end) === VIM.evaluate('a:target') then 1 else 0 end}")
++    " Use Regexp.new, so the pattern stays untrusted data and cannot inject Ruby
++    ruby VIM.command("return #{if (begin; Regexp.new(VIM.evaluate('pattern')); rescue RegexpError; end) === VIM.evaluate('a:target') then 1 else 0 end}")
+   else
+     return 0
+   endif
+diff -up vim82/src/testdir/test_filetype.vim.cucumber-code-inject vim82/src/testdir/test_filetype.vim
+--- vim82/src/testdir/test_filetype.vim.cucumber-code-inject	2026-06-30 15:35:41.138110899 +0200
++++ vim82/src/testdir/test_filetype.vim	2026-06-30 15:36:47.232303826 +0200
+@@ -786,4 +786,35 @@ func Test_pp_file()
+ endfunc
+ 
+ 
++func Test_cucumber_code_injection()
++  source check.vim
++  CheckFeature ruby
++  filetype plugin on
++
++  call mkdir('Xcucu/features/step_definitions', 'pR')
++  call writefile([
++        \ 'Feature: demo',
++        \ '  Scenario: trigger',
++        \ '    Given xyzzy',
++        \ ], 'Xcucu/features/test.feature')
++  let marker = getcwd() . '/Xcucu/MARKER'
++  " Malicious step: terminates the regex literal, injects Ruby system(),
++  " comments the trailing slash.  With the fix, the pattern is passed to
++  " Regexp.new() instead of Kernel.eval() and the payload is inert.
++  call writefile([
++        \ 'Given /xyzzy/; system("touch ' . marker . '"); #/ do',
++        \ 'end',
++        \ ], 'Xcucu/features/step_definitions/poc.rb')
++
++  new Xcucu/features/test.feature
++  call assert_equal('cucumber', &filetype)
++  call cursor(3, 1)
++  " Triggers s:jump -> s:steps -> s:stepmatch on every discovered step,
++  " including the malicious one.  Suppress preview and error messages.
++  silent! normal [d
++  call assert_false(filereadable(marker), 'Ruby injection executed')
++  bwipe!
++  filetype plugin off
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/testdir/test_filetype.vim b/src/testdir/test_filetype.vim
+index 21e2c1d..5308fbb 100644
+--- a/src/testdir/test_filetype.vim
++++ b/src/testdir/test_filetype.vim
+@@ -791,7 +791,7 @@ func Test_cucumber_code_injection()
+   CheckFeature ruby
+   filetype plugin on
+ 
+-  call mkdir('Xcucu/features/step_definitions', 'pR')
++  call mkdir('Xcucu/features/step_definitions', 'p')
+   call writefile([
+         \ 'Feature: demo',
+         \ '  Scenario: trigger',
+@@ -814,6 +814,7 @@ func Test_cucumber_code_injection()
+   silent! normal [d
+   call assert_false(filereadable(marker), 'Ruby injection executed')
+   bwipe!
++  call delete('Xcucu', 'rf')
+   filetype plugin off
+ endfunc
+ 
diff --git a/vim.spec b/vim.spec
index 8cdd344e..02775b85 100644
--- a/vim.spec
+++ b/vim.spec
@@ -27,7 +27,7 @@ Summary: The VIM editor
 URL:     http://www.vim.org/
 Name: vim
 Version: %{baseversion}.%{patchlevel}
-Release: 32%{?dist}
+Release: 33%{?dist}
 License: Vim and MIT
 Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
 Source1: virc
@@ -202,6 +202,10 @@ Patch3071: 0001-patch-9.2.0277-tests-test_modeline.vim-fails.patch
 # https://redhat.atlassian.net/browse/RHEL-178242
 # https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1
 Patch3072: 0001-patch-9.2.0479-security-runtime-tar-command-injectio.patch
+# RHEL-185873 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin
+# https://redhat.atlassian.net/browse/RHEL-185873
+# https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934
+Patch3073: 0001-patch-9.2.0496-security-Code-Injection-in-cucumber-f.patch
 
 
 # gcc is no longer in buildroot by default
@@ -462,6 +466,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
 %patch -P 3070 -p1 -b .modeline-bypass
 %patch -P 3071 -p1 -b .modeline-tests
 %patch -P 3072 -p1 -b .tar-cmd-inject
+%patch -P 3073 -p1 -b .cucumber-code-inject
 
 %build
 cd src
@@ -1014,6 +1019,9 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
 %endif
 
 %changelog
+* Thu Jul 16 2026 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-33
+- RHEL-185873 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin
+
 * Thu Jul 16 2026 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-32
 - RHEL-178242 CVE-2026-46483 vim: command injection in tar plugin