CVE-2026-43961

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.480

Description A flaw in the netrw plugin allows arbitrary Vimscript execution when processing a crafted filename containing quote characters and expression fragments. This occurs during mark/unmark operations, where the input can break out of the quoted context. An attacker can leverage this to execute shell commands with the privileges of the user running Vim. This issue is a result of the software constructing a code segment using externally-influenced input without properly neutralizing special elements that modify the syntax or behavior of the intended code.

Recommendations Upgrade to version 9.2.480.