Vulnerability · Published Aug 19, 2026 · Assigned by redhat
CVE-2026-43961Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution
High 7.8
In plain English
A high-severity code injection in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | vim | 9.2.0481-r0 | ALPINE-CVE-2026-43961 |
| Alpine:v3.24 | vim | 9.2.0481-r0 | ALPINE-CVE-2026-43961 |
| Debian:12 | vim | no fix listed | DEBIAN-CVE-2026-43961 |
| Debian:13 | vim | 2:9.1.1230-2+deb13u1 | DEBIAN-CVE-2026-43961 |
| Debian:14 | vim | 2:9.2.0524-1 | DEBIAN-CVE-2026-43961 |
| Ubuntu:22.04:LTS | vim | 2:8.2.3995-1ubuntu2.31 | UBUNTU-CVE-2026-43961 |
| Ubuntu:24.04:LTS | vim | 2:9.1.0016-1ubuntu7.15 | UBUNTU-CVE-2026-43961 |
| Ubuntu:25.10 | vim | 2:9.1.0967-1ubuntu6.6 | UBUNTU-CVE-2026-43961 |
| Ubuntu:26.04:LTS | vim | 2:9.1.2141-1ubuntu4.3 | UBUNTU-CVE-2026-43961 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| vim | vim | 0 – before 9.2.0480 |
| Red Hat | Red Hat Hardened Images | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
| Red Hat | Red Hat OpenShift Container Platform 5 | see references |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- RHSA-2026:57614 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-43961 vdb-entry, x_refsource_REDHAT
- RHBZ#2460434 issue-tracking, x_refsource_REDHAT
- https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3
- http://www.openwall.com/lists/oss-security/2026/05/14/7