Description
A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.
Published: 2026-08-19
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution which can then be leveraged to run shell commands with the privileges of the Vim user, posing a local code execution risk.

Affected Systems

This vulnerability affects Red Hat products, including Red Hat Enterprise Linux versions 6 through 10 and Red Hat OpenShift Container Platform 4. Users running these distribution releases should verify the exact Vim package version for support.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity. EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability is likely exploited by an attacker who can place a maliciously crafted filename on a filesystem the user can access, and then has the user browse the directory with Vim’s netrw plugin, leading to arbitrary Vimscript and shell execution as that user.

Generated by OpenCVE AI on August 20, 2026 at 16:23 UTC.

Remediation

Vendor Workaround

To mitigate this issue, users should avoid browsing untrusted directories or interacting with files from untrusted sources using Vim's netrw plugin. Exercise caution when opening directories that may contain maliciously crafted filenames.

OpenCVE Recommended Actions

  • Apply the latest patched Vim release from your distribution and upgrade any affected Red Hat packages.
  • Avoid browsing untrusted directories or interacting with files from untrusted sources using Vim’s netrw plugin, as recommended by the vendor.
  • If possible, disable the netrw plugin or use an alternative file manager when handling directories that may contain malicious filenames.

Generated by OpenCVE AI on August 20, 2026 at 16:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8415-1 Vim vulnerabilities
History

Fri, 21 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Container Platform
Vim
Vim vim
Vendors & Products Redhat openshift Container Platform
Vim
Vim vim

Thu, 20 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 19 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.
Title Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
Weaknesses CWE-94
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Redhat Enterprise Linux Openshift Openshift Container Platform
Vim Vim
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-01T08:33:23.804Z

Reserved: 2026-05-04T18:07:21.843Z

Link: CVE-2026-43961

cve-icon Vulnrichment

Updated: 2026-08-19T14:15:30.768Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-19T14:17:31.793

Modified: 2026-09-01T09:16:43.700

Link: CVE-2026-43961

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-19T13:26:06Z

Links: CVE-2026-43961 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T21:16:30Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')