CVE-2026-43961

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

A vulnerability has been found in vim up to 9.2.479 (Word Processing Software) and classified as critical. The CWE definition for the vulnerability is CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. As an impact it is known to affect confidentiality, integrity, and availability. Upgrading to version 9.2.480 eliminates this vulnerability.(CVE-2026-43961)

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

A vulnerability has been found in vim up to 9.2.479 (Word Processing Software) and classified as critical. The CWE definition for the vulnerability is CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. As an impact it is known to affect confidentiality, integrity, and availability. Upgrading to version 9.2.480 eliminates this vulnerability.(CVE-2026-43961)

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

A vulnerability has been found in vim up to 9.2.479 (Word Processing Software) and classified as critical. The CWE definition for the vulnerability is CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. As an impact it is known to affect confidentiality, integrity, and availability. Upgrading to version 9.2.480 eliminates this vulnerability.(CVE-2026-43961)

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

A vulnerability has been found in vim up to 9.2.479 (Word Processing Software) and classified as critical. The CWE definition for the vulnerability is CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. As an impact it is known to affect confidentiality, integrity, and availability. Upgrading to version 9.2.480 eliminates this vulnerability.(CVE-2026-43961)

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.

• SECURITY UPDATE: code injection in the netrw plugin via the mf (mark file) command: s:NetrwMarkFile() embedded the marked filename into a filter() expression by string concatenation, so a crafted filename containing vimscript (e.g. nested execute()) was evaluated when the user marked it in a netrw listing.
  • debian/patches/CVE-2026-43961.patch: reference the filename variable directly in the filter() expression instead of concatenating it, in runtime/autoload/netrw.vim; matches upstream patch 9.2.0480.
  • CVE-2026-43961

• CVE-2026-73073: fix command injection via a crafted typename in ccomplete.vim omni completion (upstream 9.2.0845)
• CVE-2026-43961: fix command injection via a crafted filename in netrw marked-file handling (upstream 9.2.0480)

• CVE-2026-73073: fix command injection via a crafted typename in ccomplete.vim omni completion (upstream 9.2.0845)
• CVE-2026-43961: fix command injection via a crafted filename in netrw marked-file handling (upstream 9.2.0480)
• CVE-2026-47167: fix Ruby code execution via a crafted pattern in the cucumber ftplugin (upstream 9.2.0496)

• CVE-2026-73073: fix command injection via a crafted typename in ccomplete.vim omni completion (upstream 9.2.0845)
• CVE-2026-43961: fix command injection via a crafted filename in netrw marked-file handling (upstream 9.2.0480)
• CVE-2026-47167: fix Ruby code execution via a crafted pattern in the cucumber ftplugin (upstream 9.2.0496)

Heap Buffer Overflow in spell file loading affects Vim < 9.2.0450. (CVE-2026-45130) Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename affects Vim < 9.2.0480. (CVE-2026-43961) Command Injection in tar.vim affects Vim < 9.2.0479. (CVE-2026-46483) Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name affects Vim < 9.2.0495. Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex affects Vim < 9.2.0496.

These are all security issues fixed in the gvim-9.2.0530-1.1 package on the GA media of openSUSE Tumbleweed.

This update for vim fixes the following issues

• CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).
• CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim (bsc#1264706).
• CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).
• CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line completion (bsc#1264707).
• CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).
• CVE-2026-46483: command injection via tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems (bsc#1265360).

Changes for vim:

• Update to v9.2.0530.
• Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)

Root has patched CVE-2026-43961 in the vim package for Root:Debian:11. Multiple fixed versions available.

This update for vim fixes the following issues

• CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).
• CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim (bsc#1264706).
• CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).
• CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line completion (bsc#1264707).
• CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).
• CVE-2026-46483: command injection via tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems (bsc#1265360).

Changes for vim:

• Update to v9.2.0530.
• Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)

This update for vim fixes the following issues

• CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).
• CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim (bsc#1264706).
• CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).
• CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line completion (bsc#1264707).
• CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).
• CVE-2026-46483: command injection via tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems (bsc#1265360).

Changes for vim:

• Update to v9.2.0530.
• Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)

This update for vim fixes the following issues

• CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).
• CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim (bsc#1264706).
• CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).
• CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line completion (bsc#1264707).
• CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).
• CVE-2026-46483: command injection via tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems (bsc#1265360).

Changes for vim:

• Update to v9.2.0530.
• Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)

This update for vim fixes the following issues

• CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim (bsc#1264706).
• CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).
• CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line completion (bsc#1264707).
• CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).
• CVE-2026-46483: command injection via tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems (bsc#1265360).

Changes for vim:

• Update to v9.2.0530.
• Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)

This update for vim fixes the following issues

• CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim (bsc#1264706).
• CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).
• CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line completion (bsc#1264707).
• CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).
• CVE-2026-46483: command injection via tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems (bsc#1265360).

Changes for vim:

• Update to v9.2.0530.
• Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)

This update for vim fixes the following issues

• CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim (bsc#1264706).
• CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).
• CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line completion (bsc#1264707).
• CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).
• CVE-2026-46483: command injection via tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems (bsc#1265360).

Changes for vim:

• Update to v9.2.0530.
• Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)

This update for vim fixes the following issues

• CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim (bsc#1264706).
• CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).
• CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line completion (bsc#1264707).
• CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).
• CVE-2026-46483: command injection via tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems (bsc#1265360).

Changes for vim:

• Update to v9.2.0530.
• Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)

This update for vim fixes the following issues

• CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).
• CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim (bsc#1264706).
• CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).
• CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line completion (bsc#1264707).
• CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).
• CVE-2026-46483: command injection via tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems (bsc#1265360).

Changes for vim:

• Update to v9.2.0530.
• Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)

It was discovered that Vim incorrectly handled marked filenames in the netrw plugin. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-43961)

It was discovered that Vim incorrectly handled filenames when decompressing certain archives. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-46483)