CVE Catalog
CVE-2026-43961
HighCVSS 7.8Summary
Vim's netrw plugin contains a vulnerability that allows arbitrary Vimscript execution via a crafted filename with quote characters and expression fragments. This can lead to shell command execution with the privileges of the user running Vim.
Risk Assessment
The risk includes malicious code execution in the user's context, potentially leading to session or system compromise.
Recommendation
Upgrade Vim to a patched version and avoid opening untrusted files.
Original NVD description (English source)
A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.