Threats affecting pkg:github/vim

CVE-2026-43961 is a high-severity vulnerability in Vim's netrw plugin that allows arbitrary code execution via crafted filenames. An attacker can create a filename containing quote characters and expression fragments that break out of quoted contexts during mark/unmark operations, enabling execution of arbitrary Vimscript and shell commands with the user's privileges. Exploitation requires local access to place malicious filenames and user interaction to browse the directory with netrw. The vulnerability affects Vim versions prior to 9.2.0480 and has been fixed in version 9.2.0480.