CVE-2026-43961

HIGH7.8

Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

Published Aug 19, 2026

Modified 2 weeks ago

Fix available

Details

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.

Affected Packages

Vim

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1703)Windows 10 (1709)Windows 10 (1803)

Fixed in:

9.2.0480

References

WEB

http://www.openwall.com/lists/oss-security/2026/05/14/7

WEB

https://access.redhat.com/security/cve/CVE-2026-43961

WEB

https://bugzilla.redhat.com/show_bug.cgi?id=2460434