CVE-2026-43961CWE-94code-injection

CVE-2026-43961

High · published August 19, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
11.9
In the wild
Unconfirmed
What it is

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00220 · 11.9th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-19T18:17Z
References (5)
https://access.redhat.com/errata/RHSA-2026:57614 · [email protected]https://access.redhat.com/security/cve/CVE-2026-43961 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2460434 · [email protected]https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3 · [email protected]http://www.openwall.com/lists/oss-security/2026/05/14/7 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 19 AUG 14:06Z
    Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution
    cvelistv5