[CVE-2026-43961]: Vim netrw has a Vimscript injection flaw where crafted filenames with quotes/expression fragments can escape quoting in s:netrwmarkfile() filter() during mark/unmark. Affects vim < 9.2.0480. Opening/browsing untrusted dirs and interacting with such files can execute arbitrary Vimscript and run shell commands as the Vim user. Patch to 9.2.0480+ and avoid untrusted directories in netrw.