CVE-2026-43961 PUBLISHED

Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

Assigner: redhat
Reserved: 04.05.2026 Published: 19.08.2026 Updated: 19.08.2026

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS Score: 7.8

Product Status

Vendor vim
Product vim
Versions Default: unaffected
  • affected from 0 to 9.2.0480 (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 7
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: unknown
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: unknown

Workarounds

To mitigate this issue, users should avoid browsing untrusted directories or interacting with files from untrusted sources using Vim's netrw plugin. Exercise caution when opening directories that may contain maliciously crafted filenames.

Credits

  • Red Hat would like to thank AISLE Research for reporting this issue.

References

Problem Types

  • Improper Control of Generation of Code ('Code Injection') CWE