[Security] MacVim affected by CVE-2026-43961 — netrw NetrwMarkFile() Vimscript injection via crafted filename (vim < 9.2.0480)
還沒有人認領這個 Issue。
評估
研究方向
從 runtime/pack/dist/opt/netrw/autoload/netrw.vim 開始，檢查 s:NetrwMarkFile()，尤其是全域 markfilelist 篩選器。將隨附的程式碼與上游提交 8af0f098c3a42a28661d0295364e6e0fd7dbc92c 進行比較。當易受攻擊的插值被上游的安全形式取代，且更新後的 Vim 原始碼已整合至 MacVim 時，即表示完成。
由索引模型根據 Issue 內容生成。
描述
[Security] MacVim affected by CVE-2026-43961 — netrw NetrwMarkFile() Vimscript injection via crafted filename (vim < 9.2.0480)
Summary
MacVim bundles the vim source at version 9.2 (patches 1-321 in the current build), which is
below the patched version 9.2.0480 that fixes CVE-2026-43961.
Vulnerability Details
- Upstream CVE: CVE-2026-43961
- Inherited from:
vim/vim - Affected code:
runtime/autoload/netrw.vim—s:NetrwMarkFile()function - Vulnerability type: CWE-94 — Improper Control of Generation of Code (Code Injection)
- Fixed in: vim 9.2.0480 (commit
8af0f098c3a42a28661d0295364e6e0fd7dbc92c)
Root Cause
In s:NetrwMarkFile() in runtime/autoload/netrw.vim, the global mark file list is
filtered using string interpolation of a user-controlled path:
" runtime/autoload/netrw.vim (macvim r183, line 5220)
let dname= netrw#fs#ComposePath(b:netrw_curdir,a:fname)
...
" remove new filename from global markfilelist
call filter(s:netrwmarkfilelist,'v:val != "'.dname.'"')
dname is composed from the current directory and the filename under the cursor (a:fname).
The filter() call evaluates its second argument as a Vimscript expression. Because dname
is interpolated directly into that expression string using '"'.dname.'"', a filename
containing a " character can escape the string context and inject arbitrary Vimscript.
Attack Scenario
- An attacker places a file named
foo"+system('id')+"barin a directory. - The victim opens that directory in netrw inside MacVim.
- The victim presses
mfto mark the file (adds it to the global mark list). - The victim presses
mfagain to unmark the file — this triggers line 5220. - The
filter()call evaluates:filter(s:netrwmarkfilelist, 'v:val != "foo"+system(''id'')+"bar"') system('id')(or any arbitrary Vimscript/shell command) executes.
This can be triggered without any special permissions; any file accessible to the user
suffices. The attack is particularly relevant when opening untrusted project directories.
Affected MacVim Code
MacVim's runtime/pack/dist/opt/netrw/autoload/netrw.vim contains the vulnerable
s:NetrwMarkFile() function. The vulnerable line is:
" netrw.vim line 5220 (macvim r183)
call filter(s:netrwmarkfilelist,'v:val != "'.dname.'"')
Note: line 5179 (buffer-local list) uses 'v:val != a:fname' (variable reference, safe).
Only the global markfilelist at line 5220 is vulnerable.
The upstream fix (vim 9.2.0480) replaces the string interpolation with a lambda:
" Fixed form (vim >= 9.2.0480)
call filter(s:netrwmarkfilelist, {_, v -> v !=# dname})
The lambda form passes dname as a closed-over variable, never interpolating it into
an evaluated expression string.
neovim is NOT affected — its runtime/pack/dist/opt/netrw/autoload/netrw.vim already
uses the lambda form (lines 5167 and 5207).
Affected MacVim Version
MacVim r183 (vim 9.2 patches 1-321) — current HEAD as of 2026-05-18.
The fix commit 8af0f098c3a42a28661d0295364e6e0fd7dbc92c from vim/vim is not present
in the macvim-dev/macvim repository:
git log --all --oneline | grep 8af0f098 # returns no output
Suggested Fix
Merge or cherry-pick vim/vim patches up to at least 9.2.0480:
The fix changes the string-interpolated filter() expression to a lambda closure, which
avoids evaluating user-controlled data as Vimscript.
References
- 主要語言
- Vim Script
- 星號
- 7.9k
- 分支
- 691
- 平均合併
- 20 分鐘
- 30 天內合併 PR
- 4
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
macvim-dev/macvim 的其他 Issue
-
難度 2/5 1-3 小時 新手友好度 68/100
macvim-dev/macvim#1697 · 6 則留言 ·
-
難度 2/5 1-3 小時 新手友好度 76/100
macvim-dev/macvim#1658 ·
-
難度 2/5 1-3 小時 新手友好度 76/100
macvim-dev/macvim#1657 ·
-
難度 2/5 1-3 小時 新手友好度 76/100
macvim-dev/macvim#1655 ·
-
難度 2/5 半天 新手友好度 72/100
macvim-dev/macvim#1653 ·
查看 macvim-dev/macvim 的全部 Issue
相似的 Issue
-
S: Untriaged T: Bug
難度 2/5 1-3 小時 新手友好度 70/100
libnyanpasu/clash-nyanpasu#5788 ·
維護者通常 1 天內回覆
-
難度 1/5 1 小時以內 新手友好度 75/100
OpenShot/openshot-qt#6202 ·
維護者通常 1 天內回覆
-
feedback
難度 2/5 1-3 小時 新手友好度 65/100
useagenthq/useagent#170 ·
維護者通常 2 天內回覆
-
bug
難度 2/5 1-3 小時 新手友好度 78/100
-
難度 2/5 1-3 小時 新手友好度 70/100
openscopeproject/TrguiNG#338 ·