SB20260610126 - Ubuntu update for vim
Published: June 10, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Code Injection (CVE-ID: CVE-2026-43961)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a local user to execute arbitrary Vimscript and shell commands.
The vulnerability exists due to improper control of generation of code in s:NetrwMarkFile() in the netrw plugin when unmarking files from the global marked-file list. A local user can create a crafted filename containing a double quote and induce the victim to mark and unmark that entry to execute arbitrary Vimscript and shell commands.
User interaction is required, and the issue only triggers on the second mf press for a given entry. Exploitation requires a Unix-like system on which filenames may contain a double quote.
2) OS Command Injection (CVE-ID: CVE-2026-46483)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to execute arbitrary shell commands.
The vulnerability exists due to improper neutralization of special elements in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives via :Vimuntar on Unix-like systems. A remote attacker can supply a crafted archive filename to execute arbitrary shell commands.
User interaction is required to open the crafted file and invoke the non-routine :Vimuntar command, and only Unix-like systems with the tar plugin enabled are vulnerable.
Remediation
Install update from vendor's website.