SB2026051518 - Code Injection in Vim

Description

This security bulletin contains information about 1 vulnerability.

1) Code Injection (CVE-ID: CVE-2026-43961)

The vulnerability allows a local user to execute arbitrary Vimscript and shell commands.

The vulnerability exists due to improper control of generation of code in s:NetrwMarkFile() in the netrw plugin when unmarking files from the global marked-file list. A local user can create a crafted filename containing a double quote and induce the victim to mark and unmark that entry to execute arbitrary Vimscript and shell commands.

User interaction is required, and the issue only triggers on the second mf press for a given entry. Exploitation requires a Unix-like system on which filenames may contain a double quote.

Remediation

Install update from vendor's website.

References

• https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3
• https://github.com/vim/vim/commit/8af0f098c3a42a28661d0295364e