Code Injection in Vim - CVE-2026-43961
Published: May 15, 2026
Vulnerability identifier: #VU131545
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-43961
CWE-ID: CWE-94
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Vim.org
Affected software:
Vim
Vim
Detailed vulnerability description
The vulnerability allows a local user to execute arbitrary Vimscript and shell commands.
The vulnerability exists due to improper control of generation of code in s:NetrwMarkFile() in the netrw plugin when unmarking files from the global marked-file list. A local user can create a crafted filename containing a double quote and induce the victim to mark and unmark that entry to execute arbitrary Vimscript and shell commands.
User interaction is required, and the issue only triggers on the second mf press for a given entry. Exploitation requires a Unix-like system on which filenames may contain a double quote.
How to mitigate CVE-2026-43961
Install security update from vendor's website.