mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2026-05-03 12:35:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.1.1947: [security]: Windows: Vim may execute commands from current directory

Browse Source 
Problem:  [security]: Windows: Vim may execute commands from current
          directory (Simon Zuckerbraun)
Solution: Set the $NoDefaultCurrentDirectoryInExePath before running
          external commands.

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-g77q-xrww-p834

083ec6d9a3

Co-authored-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
zeertzjq
2025-12-04 10:35:09 +08:00
parent 6383123326
commit ac3e2ca675
5 changed files with 41 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
runtime/lua/vim/_meta/vimfn.lua generated
View File

@@ -1652,7 +1652,8 @@ function vim.fn.eventhandler() end
--- *NoDefaultCurrentDirectoryInExePath*
--- On MS-Windows an executable in Vim's current working directory
--- is also normally found, but this can be disabled by setting
--- the $NoDefaultCurrentDirectoryInExePath environment variable.
--- the `$NoDefaultCurrentDirectoryInExePath` environment variable.
--- This is always done for |:!| commands, for security reasons.
---
--- The result is a Number:
--- 1 exists