CVE-2026-43961: 
Vim vulnerability analysis and mitigation

CVE-2026-43961 is a Vimscript code injection vulnerability in Vim's built-in netrw plugin, specifically in the s:NetrwMarkFile() function. A crafted filename containing double-quote characters and expression fragments can break out of the quoted context during mark/unmark operations, enabling arbitrary Vimscript and shell command execution. All Vim versions prior to 9.2.0480 are affected. The vulnerability was reported by Aisle Research, disclosed publicly on May 14, 2026, and carries a CVSS v3.1 base score of 7.8 (High) per Red Hat and cve.org (Red Hat CVE, GitHub Advisory).

The root cause (CWE-94: Improper Control of Generation of Code) lies in s:NetrwMarkFile() within runtime/pack/dist/opt/netrw/autoload/netrw.vim. When unmarking a file from the global marked-file list, the function interpolates the filename value directly into a string expression passed to Vim's filter() built-in: call filter(s:netrwmarkfilelist, 'v:val != "'.dname.'"'). Because filter() evaluates string arguments as Vimscript, a filename containing a " character terminates the quoted literal early, and any subsequent content in the filename is parsed and executed as Vimscript — including shell commands via execute() or :!. The injection is triggered only on the second mf keypress (the unmark action); the first press takes the safe add() branch. Exploitation requires a local attacker to plant a specially crafted filename in a directory and a victim to browse that directory with netrw and press mf twice on the malicious entry (GitHub Advisory, Openwall OSS-Security, Red Hat Bugzilla).

Successful exploitation grants an attacker arbitrary Vimscript and shell command execution with the full privileges of the user running Vim, resulting in high confidentiality, integrity, and availability impact. An attacker can read or exfiltrate any files accessible to the victim user, modify or delete data, and disrupt the editor session or destroy user-accessible data. The scope is limited to the Vim user context (no privilege escalation beyond the running user), but the impact within that context is total (Red Hat CVE, GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.014% (0.000140), reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for a Unix-like filesystem (to allow " in filenames), physical or social-engineering access to plant a crafted file, and deliberate victim interaction (pressing mf twice on the malicious entry), making opportunistic mass exploitation unlikely (GitHub Advisory, Openwall OSS-Security).

1. Craft the malicious filename: On a Unix-like system, create a file whose name contains a double-quote character followed by Vimscript payload fragments, e.g.:

mkdir netrw-poc && cd netrw-poc
python3 -c "
from pathlib import Path
name = 'x\" . execute(\"silent! !touch /tmp/pwned\") . \"'
Path(name).write_text('poc')
"

2. Plant the file: Place the crafted file in a directory the target user is likely to browse with Vim/netrw (e.g., a shared project directory, a downloaded archive, or a repository).
3. Wait for victim interaction: The victim opens Vim and navigates to the directory using netrw (e.g., :Ex or vim .).
4. Trigger the vulnerability: The victim moves the cursor to the crafted filename and presses mf once (marks the file — safe add() branch). The victim then presses mf a second time (unmarks the file — triggers the vulnerable filter() branch with the injected expression).
5. Achieve code execution: The injected Vimscript expression is evaluated, executing arbitrary shell commands (e.g., touch /tmp/pwned, reverse shell, data exfiltration) with the privileges of the user running Vim (Red Hat Bugzilla, GitHub Advisory).

• File System: Presence of files with unusual names containing double-quote (") characters in directories browsed with Vim/netrw; unexpected new files created by the Vim process (e.g., files in /tmp or the user's home directory not created by the user).
• Process: Unexpected child processes spawned by the Vim process (e.g., sh, bash, curl, wget, python) visible in process trees or audit logs.
• Logs: Audit log entries (auditd) showing file creation or network connections initiated by the Vim process; shell history entries showing commands not typed by the user.
• Network: Unexpected outbound connections from a workstation originating from the Vim process (if a reverse shell payload is used).

Upgrade Vim to version 9.2.0480 or later, which fixes the vulnerability by replacing the unsafe string interpolation in filter() with a lambda/Funcref that does not evaluate attacker-controlled data as Vimscript: call filter(s:netrwmarkfilelist, {_, v -> v !=# dname}). As a workaround, avoid browsing untrusted directories with Vim's netrw plugin, and do not interact with files that have unusual or suspicious names containing special characters such as double quotes. Distribution-specific patches are available from SUSE, Ubuntu (USN-8415-1), Amazon Linux 2023, openSUSE, and Mageia (GitHub Advisory, Red Hat CVE, Ubuntu Advisory).

The vulnerability was publicly disclosed by Vim maintainer Christian Brabandt via the oss-security mailing list on May 14, 2026, crediting Aisle Research for discovery and analysis (Openwall OSS-Security). Red Hat issued an advisory classifying the impact as "Important" and noted that exploitation requires local file placement and explicit user interaction (Red Hat CVE). The GitHub security advisory rates the severity as "Moderate" (CVSS 4.8 under GitHub's scoring), noting it is "highly unlikely that a user would press mf twice on such a suspicious filename" (GitHub Advisory). Multiple Linux distributions including SUSE, Ubuntu, Mageia, and Amazon Linux issued security updates, and the vulnerability received coverage from security news aggregators and scanner vendors including Tenable and Qualys.