Y2Y2
Open Cyber
Public vulnerability disclosure

CVE-2026-43961

Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

publishedCWE-94

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.

Investigate in Cyber JSONMarkdown
Technical severity7.8 highCVSS 3.1 · CNA: redhat
Published2026-08-19Source updated 2026-11-02
Collected2026-11-022 attributed sources

Fixes and workarounds

Workaround

To mitigate this issue, users should avoid browsing untrusted directories or interacting with files from untrusted sources using Vim's netrw plugin. Exercise caution when opening directories that may contain maliciously crafted filenames.

Source: CNA: redhat

Affected products and versions

ProductVersionsAuthority
vim
vim 		≥ 0; < 9.2.0480 (affected, semver)
Other versions: unaffected 		CNA: redhat
Red Hat Hardened Images
Red Hat
vim-main
https://catalog.redhat.com/software/containers/ 		≥ 9.2.967-1.1.hum1; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 10
Red Hat
vim
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 6
Red Hat
vim
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unknown 		CNA: redhat
Red Hat Enterprise Linux 7
Red Hat
vim
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 8
Red Hat
vim
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9
Red Hat
vim
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat
Red Hat OpenShift Container Platform 4
Red Hat
openshift/ose-rhel-coreos-8
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unaffected 		CNA: redhat
Red Hat OpenShift Container Platform 4
Red Hat
openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unaffected 		CNA: redhat
Red Hat OpenShift Container Platform 5
Red Hat
openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unaffected 		CNA: redhat

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

Version / scoreVectorAuthority
3.1 / 7.8
high		 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCNA: redhat

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References