Code execution via filename injection in netrw

Code injection in Vim netrw before 9.2.0480 allows attackers to execute arbitrary Vimscript via a crafted filename in a browsed directory. In s:NetrwMarkFile(), unmarking an entry concatenates the derived path into a quoted filter() expression, so a double quote in the filename ends the literal early and injects Vimscript that filter() evaluates. Exploitation requires a local attacker to plant the filename on a Unix-like filesystem and a victim to browse that directory with netrw and press mf twice on the same entry, after which injected Vimscript can invoke shell commands as the Vim user.