diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2026-05-06 07:18:45 +0800 |
|---|---|---|
| committer | zeertzjq <zeertzjq@outlook.com> | 2026-05-06 07:23:07 +0800 |
| commit | b06f8b174fdbb9edb93d7aa7f362faac950ab993 (patch) | |
| tree | cd054c9b5349eb096cd93bd582fabd700e4e665e /runtime/lua | |
| parent | d0582fcc742ce61e5e22f19d7b097fb79ade40e7 (diff) | |
| download | rneovim-b06f8b174fdbb9edb93d7aa7f362faac950ab993.tar.gz rneovim-b06f8b174fdbb9edb93d7aa7f362faac950ab993.tar.bz2 rneovim-b06f8b174fdbb9edb93d7aa7f362faac950ab993.zip | |
vim-patch:9.2.0435: [security]: backticks in 'path' may cause shell execution on completion
Problem: [security]: Backticks enclosed shell commands in the 'path'
option value are executed during completion (q1uf3ng).
Solution: Skip path entries containing backticks, add P_SECURE to 'path'
option, so that it cannot be set from a modeline (for symmetry with
the 'cdpath' option)
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-hwg5-3cxw-wvvg
Supported by AI.
https://github.com/vim/vim/commit/190cb3c2b9c769a3972bcfd991a7b5b6cb771ef0
Co-authored-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'runtime/lua')
0 files changed, 0 insertions, 0 deletions