CVE-2026-47167 Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex

🗓️ 11 Jun 2026 18:31:44Reported by GoogleType

osv_cve🔗 osv.dev👁 19 Views

Vim vulnerable to code injection from cucumber.vim step patterns loaded from features or stories and evaluated by Ruby.

Reporter	Title	Published	Views	Family All 187
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs.	3 Nov 202610:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities	22 Oct 202612:32	–	ibm
Tenable Nessus	Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2026-1862)	22 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : vim, --advisory ALAS2-2026-3368 (ALAS-2026-3368)	22 Jun 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : vim (ALSA-2026:38510)	13 Aug 202600:00	–	nessus
Tenable Nessus	CentOS 9 : vim-8.2.2637-33.el9	20 Jul 202600:00	–	nessus
Tenable Nessus	Rocky Linux 10.2 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-data / vim-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_38509)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-common-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_38510)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 9.6 [CIQ] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (ciqsa-2026_1762)	6 Nov 202600:00	–	nessus
Tenable Nessus	Rocky Linux 9 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-common-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_38511)	1 Oct 202600:00	–	nessus

Source	Link
github	www.github.com/vim/vim/releases/tag/v9.2.0496
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47167.json
github	www.github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-47167
github	www.github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934

28 Oct 2026 11:11Current

7.3High risk

Vulners AI Score7.3

CVSS 45.1

EPSS0.00135