{"id":"CVE-2026-43961","state":"PUBLISHED","title":"Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution","description":"A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.","publishedAt":"2026-08-19T14:06:09.120Z","updatedAt":"2026-10-30T03:11:21.379Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["vim vim","Red Hat Red Hat Hardened Images","Red Hat Red Hat Enterprise Linux 10","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat OpenShift Container Platform 4","Red Hat Red Hat OpenShift Container Platform 5"],"affected":[{"vendor":"vim","product":"vim","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"9.2.0480","versionType":"semver"}],"repo":"https://github.com/vim/vim/"},{"vendor":"Red Hat","product":"Red Hat Hardened Images","packageName":"vim-main","defaultStatus":"affected","versions":[{"version":"9.2.967-1.1.hum1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"vim","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"vim","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"vim","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"vim","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"vim","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift/ose-rhel-coreos-8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift/ose-rhel-coreos-9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 5","packageName":"openshift/ose-rhel-coreos-9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"]}],"references":["https://access.redhat.com/errata/RHSA-2026:57614","https://access.redhat.com/security/cve/CVE-2026-43961","https://bugzilla.redhat.com/show_bug.cgi?id=2460434","https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3","http://www.openwall.com/lists/oss-security/2026/05/14/7"],"weaknesses":["CWE-94"],"ingestedAt":"2026-10-30T03:22:04.420Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/43xxx/CVE-2026-43961.json","commit":"a7b41c5b4ba55ca3dcfb62c0a3c113c85988e3e4","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-43961","state":"PUBLISHED","datePublished":"2026-08-19T14:06:09.120Z","dateUpdated":"2026-10-30T03:11:21.379Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-05-04T18:07:21.843Z"},"containers":{"cna":{"title":"Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution","descriptions":[{"lang":"en","value":"A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim."}],"affected":[{"vendor":"vim","product":"vim","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"9.2.0480","versionType":"semver"}],"repo":"https://github.com/vim/vim/"},{"vendor":"Red Hat","product":"Red Hat Hardened Images","packageName":"vim-main","defaultStatus":"affected","versions":[{"version":"9.2.967-1.1.hum1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"vim","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"vim","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"vim","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"vim","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"vim","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift/ose-rhel-coreos-8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift/ose-rhel-coreos-9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 5","packageName":"openshift/ose-rhel-coreos-9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:57614","name":"RHSA-2026:57614","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43961","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460434","name":"RHBZ#2460434","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3"}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-94","description":"Improper Control of Generation of Code ('Code Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-30T03:11:21.379Z"},"datePublic":"2026-08-19T13:26:06.830Z","x_redhatCweChain":"CWE-94: Improper Control of Generation of Code ('Code Injection')","workarounds":[{"lang":"en","value":"To mitigate this issue, users should avoid browsing untrusted directories or interacting with files from untrusted sources using Vim's netrw plugin. Exercise caution when opening directories that may contain maliciously crafted filenames."}],"timeline":[{"lang":"en","time":"2026-04-21T23:21:48.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-08-19T13:26:06.830Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank AISLE Research for reporting this issue."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/05/14/7"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-08-19T14:15:30.768Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-19T14:15:10.966562Z","id":"CVE-2026-43961","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-19T14:20:55.728Z"}}]}}}