CVE-2026-47167 is a vulnerability in Vim version 3.0 where the cucumber filetype plugin allows Vimscript code injection through a specially crafted step-definition regular expression. This is categorized under CWE-94, which involves code injection vulnerabilities. The vulnerability could allow an attacker to execute arbitrary Vimscript code if they can influence the step-definition regex processed by the plugin. No CVSS score or detailed impact metrics are provided, and no vendor advisory or patch information is available.

The vulnerability allows potential code injection in Vimscript via the cucumber filetype plugin, which could lead to arbitrary code execution within the context of the Vim editor. This could compromise the integrity and security of the user's environment where Vim is executed. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening files that use the cucumber filetype plugin, especially those containing untrusted step-definition regex patterns.