Description

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-19T14:17:31.793Z",
  "pubdate": "2026-08-19T14:17:31.793Z",
  "executiveSummary": "A critical security vulnerability has been identified within the netrw plugin of Vim, specifically involving improper input sanitization during file manipulation operations.\nThe vulnerability is classified as an arbitrary Vimscript execution flaw caused by an injection vector in mark and unmark operations.\nAn unauthenticated attacker capable of supplying a crafted filename containing specific quote characters and expression fragments can successfully break out of the intended quoted string context.\nThe primary impact of this vulnerability includes arbitrary Vimscript execution within the context of the running Vim instance.\nBecause Vimscript features capabilities to interface with the underlying operating system, this flaw can be directly leveraged to execute arbitrary shell commands with the privileges of the user running Vim.\nAffected systems include any environment utilizing the vulnerable netrw plugin component of Vim.\nThe risk implication is severe, as opening or interacting with maliciously crafted filenames in a vulnerable version of Vim can lead to immediate system compromise without prior authentication.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient validation and sanitization of filenames within Vim's netrw plugin during mark and unmark operations.\nThe vulnerable component is the netrw plugin script handling file list interactions and internal state tracking.\nWhen a user performs operations on files marked within netrw, the plugin dynamically constructs and evaluates Vimscript commands by interpolating filenames directly into execution strings.\nBy crafting a filename that incorporates specially constructed quote characters and expression fragments (such as Vimscript evaluation expressions), an attacker can prematurely terminate the intended string literal context.\nThis breakout allows the malicious payload to be interpreted directly as executable Vimscript by the internal expression evaluator.\nThe step-by-step attack flow proceeds as follows: First, an attacker provisions a file system entry or tricks a victim into downloading a directory structure containing a maliciously named file.\nSecond, the victim opens Vim and navigates the directory using the netrw plugin.\nThird, when the victim initiates a mark or unmark operation on the crafted filename, the netrw plugin processes the raw filename string.\nFourth, the lack of proper escaping allows the injected quote characters and expression fragments to escape the intended string context.\nFifth, the underlying Vim engine evaluates the resulting concatenated string, executing the attacker's embedded Vimscript commands.\nFinally, post-exploitation impact is realized when the executed Vimscript utilizes built-in command execution primitives (such as system() or term_start()) to spawn arbitrary shell commands, inheriting the exact privilege level of the local user running the Vim session."
}