Summary
Vim (Vi IMproved) is an updated and improved version of the vi editor.
Security Fix(es):
* vim: Vimscript injection via unescaped filename in netrw s:NetrwMarkFile() filter() expression allows arbitrary code execution (CVE-2026-43961)
Bug Fix(es) and Enhancement(s):
* vim writes file in place even though creating a backup is possible [rhel-8.10.z] (JIRA:RHEL-282852)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | vim-common | 2:8.0.1763-34.el8_10 |
| AlmaLinux · 8 | vim-enhanced | 2:8.0.1763-34.el8_10 |
| AlmaLinux · 8 | vim-filesystem | 2:8.0.1763-34.el8_10 |
| AlmaLinux · 8 | vim-minimal | 2:8.0.1763-34.el8_10 |
| AlmaLinux · 8 | vim-X11 | 2:8.0.1763-34.el8_10 |
Vulnerabilities 1
-
High 7.8
Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution
A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell comma…