vim-patch:9.1.1947: [security]: Windows: Vim may execute commands from current directory

Problem:  [security]: Windows: Vim may execute commands from current
          directory (Simon Zuckerbraun)
Solution: Set the $NoDefaultCurrentDirectoryInExePath before running
          external commands.

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-g77q-xrww-p834

083ec6d9a3

Co-authored-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
zeertzjq
2025-12-04 10:35:09 +08:00
parent 6383123326
commit ac3e2ca675
5 changed files with 41 additions and 7 deletions

View File

@@ -2163,7 +2163,8 @@ M.funcs = {
*NoDefaultCurrentDirectoryInExePath*
On MS-Windows an executable in Vim's current working directory
is also normally found, but this can be disabled by setting
the $NoDefaultCurrentDirectoryInExePath environment variable.
the `$NoDefaultCurrentDirectoryInExePath` environment variable.
This is always done for |:!| commands, for security reasons.
The result is a Number:
1 exists