Description
A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.
Published: 2026-08-19
Score: 7.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Vim's netrw plugin allows a crafted filename containing quote characters and expression fragments to break out of the quoted context during mark/unmark operations, enabling arbitrary Vimscript execution. An attacker can then run shell commands with the privileges of the user running Vim, representing a serious local code‑execution risk.

Affected Systems

This vulnerability affects Red Hat products, including Red Hat Enterprise Linux versions 6 through 10 and Red Hat OpenShift Container Platform 4. Users running these distribution releases should verify the exact Vim package version for support.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability is likely exploited by an attacker who can place a maliciously crafted filename on a filesystem the user can access, and then has the user browse the directory with Vim’s netrw plugin, leading to arbitrary Vimscript and shell execution as that user.

Generated by OpenCVE AI on August 19, 2026 at 17:37 UTC.

Remediation

Vendor Workaround

To mitigate this issue, users should avoid browsing untrusted directories or interacting with files from untrusted sources using Vim's netrw plugin. Exercise caution when opening directories that may contain maliciously crafted filenames.

OpenCVE Recommended Actions

  • Apply the latest patched Vim release from your distribution and upgrade any affected Red Hat packages.
  • Avoid browsing untrusted directories or interacting with files from untrusted sources using Vim's netrw plugin, as recommended by the vendor.
  • If possible, disable the netrw plugin or use an alternative file manager when handling directories that may contain malicious filenames.

Generated by OpenCVE AI on August 19, 2026 at 17:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8415-1 Vim vulnerabilities
History

Wed, 19 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.
Title Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
Weaknesses CWE-94
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Redhat Enterprise Linux Openshift
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-08-19T16:53:18.201Z

Reserved: 2026-05-04T18:07:21.843Z

Link: CVE-2026-43961

cve-icon Vulnrichment

Updated: 2026-08-19T14:15:30.768Z

cve-icon NVD

Status : Received

Published: 2026-08-19T14:17:31.793

Modified: 2026-08-19T17:18:48.650

Link: CVE-2026-43961

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-19T17:45:03Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')