Upwind Security MDR@UpwindMDR
Disclosure
🚨High - Vim netrw Mark/Unmark Filename Injection RCE (CVE-2026-43961) Vim’s netrw plugin mishandles quote characters in filenames during mark/unmark, allowing an attacker-controlled name to break out of quoted context and inject Vimscript expressions. Opening a directory containing the crafted filename can trigger :execute and run arbitrary shell commands as the Vim user. 👉Affected: vim (netrw plugin), rhcos (bundled vim)
Post summary
CVE-2026-43961 is a high‑severity RCE in Vim’s netrw plugin caused by a filename injection flaw that can execute arbitrary shell commands when a crafted filename is opened.
0000066
292 followersView on X
