From 799cbfff855c72282a54646f3e5e1b71b0da223c Mon Sep 17 00:00:00 2001
From: "Justin M. Keyes" <justinkz@gmail.com>
Date: Wed, 20 May 2026 15:27:43 -0400
Subject: fix(vim.secure): read() command injection vulnerability #39918

Problem:
Malicious filename can execute code because of ":" cmdline expansion.

Solution:
Use `fnameescape()`.

fix https://github.com/neovim/neovim/issues/39914
---
 runtime/lua/vim/secure.lua | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'runtime/lua/vim/secure.lua')

diff --git a/runtime/lua/vim/secure.lua b/runtime/lua/vim/secure.lua
index 63cf4a8776..de744ed008 100644
--- a/runtime/lua/vim/secure.lua
+++ b/runtime/lua/vim/secure.lua
@@ -151,7 +151,7 @@ function M.read(path)
     return nil
   elseif result == 2 then
     -- View
-    vim.cmd('sview ' .. fullpath)
+    vim.cmd(('sview %s'):format(vim.fn.fnameescape(fullpath)))
     return nil
   elseif result == 3 then
     -- Deny
-- 
cgit