CVE-2026-43961
vim · Vulnerability
CVSS 3.1 7.8 HIGHCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-43961
PublishedA flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-43961 · CVE overview and exploitation status
cve-program · CVE-2026-43961
- https://access.redhat.com/errata/RHSA-2026:57614
- https://access.redhat.com/errata/RHSA-2026:98119
- https://access.redhat.com/errata/RHSA-2026:99165
- https://access.redhat.com/errata/RHSA-2026:99166
- https://access.redhat.com/security/cve/CVE-2026-43961
- https://bugzilla.redhat.com/show_bug.cgi?id=2460434
- https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3
Related changes
Linked by CVE identifier- Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution · Affected-version evidence changed · 12 Nov 2026
- Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution · Affected-version evidence changed · 11 Nov 2026
- Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution · Affected-version evidence changed · 11 Nov 2026
- Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution · Affected-version evidence changed · 6 Nov 2026
- Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution · Affected-version evidence changed · 4 Nov 2026
- Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution · Affected-version evidence changed · 30 Oct 2026