From: Siddharth Doshi <[email protected]> Picking patch as per [1], and same patch is mentioned in [2]
References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-47167 [2] https://security-tracker.debian.org/tracker/CVE-2026-47167 Signed-off-by: Siddharth Doshi <[email protected]> Signed-off-by: Yoann Congal <[email protected]> --- .../vim/files/CVE-2026-47167.patch | 102 ++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 103 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-47167.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-47167.patch b/meta/recipes-support/vim/files/CVE-2026-47167.patch new file mode 100644 index 00000000000..f9a989cf3af --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-47167.patch @@ -0,0 +1,102 @@ +From 5eb4bd1c12801f9ffb451f22b4d459ff2b7ff962 Mon Sep 17 00:00:00 2001 +From: Christian Brabandt <[email protected]> +Date: Sun, 17 May 2026 19:39:24 +0000 +Subject: [PATCH 4/6] patch 9.2.0496: [security]: Code Injection in cucumber + filetype plugin + +Problem: [security]: Code Injection in cucumber filetype plugin + (Christopher Lusk) +Solution: Use rubys Regexp.new() with the untrusted pattern + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9 + +Signed-off-by: Christian Brabandt <[email protected]> + +Upstream-Status: Backport [https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934] +CVE: CVE-2026-47167 +Signed-off-by: Siddharth Doshi <[email protected]> +--- + runtime/ftplugin/cucumber.vim | 5 ++++- + src/testdir/test_filetype.vim | 30 ++++++++++++++++++++++++++++++ + src/version.c | 2 ++ + 3 files changed, 36 insertions(+), 1 deletion(-) + +diff --git a/runtime/ftplugin/cucumber.vim b/runtime/ftplugin/cucumber.vim +index f4848d1c60..9723898d15 100644 +--- a/runtime/ftplugin/cucumber.vim ++++ b/runtime/ftplugin/cucumber.vim +@@ -2,6 +2,8 @@ + " Language: Cucumber + " Maintainer: Tim Pope <[email protected]> + " Last Change: 2016 Aug 29 ++" 2026 May 26 by Vim Project: prevent Code Injection ++" https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9 + + " Only do this when not done yet for this buffer + if (exists("b:did_ftplugin")) +@@ -96,7 +98,8 @@ function! s:stepmatch(receiver,target) + catch + endtry + if has("ruby") && pattern !~ '\\\@<!#{' +- ruby VIM.command("return #{if (begin; Kernel.eval('/'+VIM.evaluate('pattern')+'/'); rescue SyntaxError; end) === VIM.evaluate('a:target') then 1 else 0 end}") ++ " Use Regexp.new, so the pattern stays untrusted data and cannot inject Ruby ++ ruby VIM.command("return #{if (begin; Regexp.new(VIM.evaluate('pattern')); rescue RegexpError; end) === VIM.evaluate('a:target') then 1 else 0 end}") + else + return 0 + endif +diff --git a/src/testdir/test_filetype.vim b/src/testdir/test_filetype.vim +index 70e269ee63..f6956795da 100644 +--- a/src/testdir/test_filetype.vim ++++ b/src/testdir/test_filetype.vim +@@ -3433,4 +3433,34 @@ func Test_app_file() + filetype off + endfunc + ++func Test_cucumber_code_injection() ++ CheckFeature ruby ++ filetype plugin on ++ ++ call mkdir('Xcucu/features/step_definitions', 'pR') ++ call writefile([ ++ \ 'Feature: demo', ++ \ ' Scenario: trigger', ++ \ ' Given xyzzy', ++ \ ], 'Xcucu/features/test.feature') ++ let marker = getcwd() . '/Xcucu/MARKER' ++ " Malicious step: terminates the regex literal, injects Ruby system(), ++ " comments the trailing slash. With the fix, the pattern is passed to ++ " Regexp.new() instead of Kernel.eval() and the payload is inert. ++ call writefile([ ++ \ 'Given /xyzzy/; system("touch ' . marker . '"); #/ do', ++ \ 'end', ++ \ ], 'Xcucu/features/step_definitions/poc.rb') ++ ++ new Xcucu/features/test.feature ++ call assert_equal('cucumber', &filetype) ++ call cursor(3, 1) ++ " Triggers s:jump -> s:steps -> s:stepmatch on every discovered step, ++ " including the malicious one. Suppress preview and error messages. ++ silent! normal [d ++ call assert_false(filereadable(marker), 'Ruby injection executed') ++ bwipe! ++ filetype plugin off ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +diff --git a/src/version.c b/src/version.c +index cf62805e44..03a520b146 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -734,6 +734,8 @@ static char *(features[]) = + + static int included_patches[] = + { /* Add new patch number below this line */ ++/**/ ++ 496, + /**/ + 495, + /**/ +-- +2.34.1 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 8360b1622de..7a4a0bc932f 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -26,6 +26,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV} file://CVE-2026-42307.patch \ file://CVE-2026-43961.patch \ file://CVE-2026-47162.patch \ + file://CVE-2026-47167.patch \ " PV .= ".0340"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242151): https://lists.openembedded.org/g/openembedded-core/message/242151 Mute This Topic: https://lists.openembedded.org/mt/120476117/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
