The vulnerability exists in Vim's cucumber filetype plugin. Step‑definition patterns read from .rb files in features/* or stories/* directories are inserted into a Ruby Kernel.eval call without proper escaping. This allows an attacker who controls a repository to craft a regex that contains arbitrary Ruby code, which will be executed whenever the user triggers the step‑jump mapping. The weakness is a classic code injection (CWE‑94) coupled with unsafe evaluation of user input (CWE‑95).

Affected products include Vim (open‑source command‑line editor) running with +ruby support before version 9.2.0496. The patch is in release 9.2.0496, and any earlier Vim builds that load runtime/ftplugin/cucumber.vim on an attacker‑controlled repository are vulnerable. All platforms that compile Vim with Ruby support are potentially impacted.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local user to open a malicious repository and invoke the step‑jump mapping; thus the attack vector is local and depends on the presence of +ruby support. While unlikely to be delivered remotely, a compromised user could gain full control of the local system through arbitrary shell commands executed by the injected Ruby code.