Is CVE-2026-43961 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-43961?

CVE-2026-43961 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-43961

Description

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.