# CVE-2026-43961: Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

Status: published. Published: 2026-08-19. Updated: 2026-11-02.

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.

## Remediation

- workaround: To mitigate this issue, users should avoid browsing untrusted directories or interacting with files from untrusted sources using Vim's netrw plugin. Exercise caution when opening directories that may contain maliciously crafted filenames. (source: CNA: redhat)

## Affected products and versions

- vim / vim: ≥ 0; < 9.2.0480 (affected, semver). Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (vim-main): ≥ 9.2.967-1.1.hum1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 10 (vim): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 6 (vim): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (vim): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (vim): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (vim): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-8): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 5 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; source: CNA: redhat

- CISA KEV: No listing in collected sources

- EPSS: 0.16% as of 2026-11-01; percentile 5.05%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-94

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2026:57614 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2026-43961 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2460434 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3 (CNA: redhat)

- http://www.openwall.com/lists/oss-security/2026/05/14/7 (ADP: CVE)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-43961; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-43961; retrieved 2026-11-02; source updated Not reported

Revision: d686efefc85b6c04d0e0597ec1c0981836c5e869a4fbe43df8912f53adaba568

Canonical: https://y2.dev/cve/CVE-2026-43961