diff --git a/runtime/ftplugin/racket.vim b/runtime/ftplugin/racket.vim
index b8004a93af..14a98ab790 100644
--- a/runtime/ftplugin/racket.vim
+++ b/runtime/ftplugin/racket.vim
@@ -4,6 +4,7 @@
 " Previous Maintainer:  Will Langstroth <will@langstroth.com>
 " URL:                  https://github.com/benknoble/vim-racket
 " Last Change:          2025 Aug 09
+" 2026 Mar 31 by Vim project: use shellescape for the K mapping
 
 if exists("b:did_ftplugin")
   finish
@@ -51,7 +52,7 @@ if !exists("no_plugin_maps") && !exists("no_racket_maps")
     try
       let l:old_a = @a
       normal! gv"ay
-      call system("raco docs '". @a . "'")
+      call system("raco docs '". shellescape(@a) . "'")
       redraw!
       return @a
     finally
diff --git a/runtime/syntax/tera.vim b/runtime/syntax/tera.vim
index 90cf5171eb..e151e8674b 100644
--- a/runtime/syntax/tera.vim
+++ b/runtime/syntax/tera.vim
@@ -2,6 +2,7 @@
 " Language:	Tera
 " Maintainer:	Muntasir Mahmud <muntasir.joypurhat@gmail.com>
 " Last Change:	2026 Jan 29
+" 2026 Mar 31 by Vim project: prevent code execution in filename
 
 if exists("b:current_syntax")
   finish
@@ -22,7 +23,7 @@ endif
 
 " Load the underlying language syntax if detected
 if s:underlying_filetype != ""
-  execute "runtime! syntax/" . s:underlying_filetype . ".vim"
+  execute "runtime! syntax/" . fnameescape(s:underlying_filetype) . ".vim"
   unlet! b:current_syntax
 else
   " Default to HTML if no specific language detected