CVE-2026-43961: 
Vim vulnerability analysis and mitigation

CVE-2026-43961 is a Vimscript code injection vulnerability in Vim's built-in netrw plugin, specifically in the s:NetrwMarkFile() function. A crafted filename containing double-quote characters and expression fragments can break out of a quoted filter() expression during mark/unmark operations, enabling arbitrary Vimscript and shell command execution with the privileges of the user running Vim. All Vim versions prior to 9.2.0480 are affected. The vulnerability was reported by Aisle Research, disclosed publicly on May 14, 2026, and carries a CVSS v3.1 base score of 7.8 (High) per Red Hat (Red Hat CVE, GitHub Advisory).

The root cause is CWE-94 (Improper Control of Generation of Code) and CWE-74 (Injection into a Downstream Component). In netrw.vim, the s:NetrwMarkFile() function constructs a filter() call by directly interpolating the filename value (dname) into a string expression: call filter(s:netrwmarkfilelist, 'v:val != "'.dname.'"'). Because filter() evaluates its string argument as Vimscript, a filename containing a " character terminates the quoted literal prematurely, and any subsequent content in the filename is parsed and executed as Vimscript — including execute("!cmd") to run arbitrary shell commands. The injection is triggered only on the second mf keypress (unmark), as the first press takes the safe add() branch. The attack vector is local, requiring the attacker to plant a crafted filename in a directory the victim browses with netrw (Red Hat Bugzilla, oss-security).

Successful exploitation grants an attacker arbitrary Vimscript and shell command execution with the full privileges of the user running Vim, resulting in high confidentiality, integrity, and availability impact. An attacker can read or exfiltrate any files accessible to the victim user, modify or delete data, and disrupt the editor session or destroy user-accessible data. While the scope is limited to the Vim user context (no privilege escalation beyond that user), on systems where Vim is run as a privileged user or in automated pipelines, the impact could extend further (Red Hat CVE, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Red Hat CVE). The EPSS score is approximately 0.014% (0.000140), reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is non-trivial: it requires the attacker to plant a specially crafted filename in a directory the victim browses with netrw, and the victim must press mf twice on that specific entry — a sequence considered unlikely for a suspiciously named file (GitHub Advisory, oss-security).

1. Craft the malicious filename: On a Unix-like system (where filenames may contain double quotes), create a file whose name injects Vimscript into the filter() expression. Example using Python:

from pathlib import Path
name = 'x" . execute("silent! !touch /tmp/pwned") . "'
Path(name).write_text('poc\n')

2. Plant the file: Place the crafted file in a directory the victim is likely to browse with Vim's netrw (e.g., a shared folder, a project directory, or a directory sent as part of a file archive).
3. Wait for victim interaction: The victim opens Vim and navigates to the directory using netrw (e.g., via :Ex or :Explore).
4. Trigger the injection: The victim moves the cursor to the crafted filename and presses mf once (marks the file — safe, takes the add() branch), then presses mf a second time (unmarks the file — triggers the vulnerable filter() branch, executing the injected Vimscript).
5. Shell command executes: The injected execute("!cmd") fragment runs the attacker's shell command with the privileges of the Vim process. The side effect (e.g., a new file created, a reverse shell spawned) confirms successful exploitation (Red Hat Bugzilla, oss-security).

• File System: Presence of files with unusual names containing double-quote characters (") in directories browsed with Vim/netrw; unexpected new files created in /tmp or user home directories (e.g., netrw_injection_poc) following Vim usage; unauthorized modifications to user-accessible files.
• Process: Unexpected child processes spawned by the Vim process (e.g., /bin/sh, /bin/bash, curl, wget, python3) visible in process trees or audit logs; shell commands executed under the Vim process's PID.
• Logs: System audit logs (auditd) showing execve syscalls originating from a Vim parent process for unexpected commands; shell history entries for commands not directly typed by the user.
• Network: Outbound network connections from the Vim process or its child processes to unexpected external hosts (indicative of reverse shell or data exfiltration payloads) (Red Hat Bugzilla).

Upgrade Vim to version 9.2.0480 or later, which fixes the vulnerability by replacing the unsafe string interpolation in filter() with a lambda/Funcref that does not evaluate attacker-controlled data as Vimscript (GitHub Advisory). Distribution-specific patches are available for RHEL 8/9/10, SUSE/openSUSE, Ubuntu (USN-8415-1), Fedora, Mageia, and Amazon Linux 2023 (Red Hat CVE). As a workaround where patching is not immediately possible, avoid browsing untrusted directories with Vim's netrw plugin, and do not interact with files from untrusted sources — particularly those with unusual or suspicious filenames containing special characters or quote marks.

The Vim project (Christian Brabandt) disclosed the vulnerability via the oss-security mailing list on May 14, 2026, crediting Aisle Research for discovery and analysis (oss-security). Red Hat issued a formal advisory classifying the impact as "Important" and noted that exploitation requires local file placement and explicit user interaction (Red Hat CVE). The GitHub security advisory rates the severity as "Moderate" (CVSS 4.8 under GitHub's scoring), noting that the double-mf interaction on a suspiciously named file makes exploitation unlikely in practice (GitHub Advisory). Multiple Linux distributions (SUSE, Ubuntu, Mageia, Amazon Linux) issued security updates promptly following disclosure.