zeertzjq 72b2c713ea vim-patch:9.2.0845: [security]: arbitrary Ex command execution during C omni-completion ...

Problem:  [security]: arbitrary Ex command execution during C
          omni-completion (Threonine)
Solution: Match tags typeref literally to block Ex command injection
          (Yasuhiro Matsumoto).

Escaping only "/" and "\" left the typeref able to break out of the
:vimgrep pattern without a "/": an unclosed "[" makes vimgrep's pattern
skipping fail, and the parser then treats a following "|" as a command
separator, so the tag value runs as Ex commands during C omni-completion.
Match the field literally with \V so no regex metacharacter can affect
pattern parsing.

Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-cx73-phcg-3j5g

2f628d8104

Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>

2026-07-25 06:23:13 +08:00

..

autoload

vim-patch:9.2.0845: [security]: arbitrary Ex command execution during C omni-completion

2026-07-25 06:23:13 +08:00

colors

vim-patch:c99aaf4: runtime(colors): improve catppuccin colorscheme

2026-02-01 08:22:07 +08:00

compiler

vim-patch:91023ad: runtime(cabal): Update compiler, ftplugin, syntax, add indent script

2026-06-27 07:04:55 +08:00

doc

feat(options): schema, "dict" options, messages

2026-07-24 13:05:20 +02:00

ftplugin

vim-patch:9.2.0839: [security]: arbitrary code execution via keyword lookup

2026-07-24 08:14:04 +08:00

indent

vim-patch:9.2.0788: filetype: hip files are not recognized (#40809)

2026-07-18 22:19:48 +08:00

keymap

vim-patch:5c855ce: runtime: convert *_utf-8.vim files to actual UTF-8 encoding

2026-01-26 06:53:53 +08:00

lua

feat(health): improvements to :checkhealth #40935

2026-07-24 11:54:12 -04:00

pack/dist/opt

vim-patch:9.2.0840: [security]: code injection in netrw via bookmarks

2026-07-24 08:14:20 +08:00

plugin

feat(dir): support counts for parent navigation #40927

2026-07-24 06:48:47 -04:00

queries

fix(treesitter): queries for bundled diff parser #40866

2026-07-22 12:03:34 -04:00

scripts

feat(float): 'previewpopup' option #26799

2026-07-23 17:27:14 -04:00

spell

…

syntax

vim-patch:9.2.0836: filetype: .git-blame-ignore-revs file is not recognized (#40912)

2026-07-23 09:03:07 +08:00

tutor

refactor(tutor): use inline comments instead of json file #39714

2026-05-13 07:31:17 -04:00

CMakeLists.txt

feat(build): rename io.neovim.nvim to org.neovim.nvim

2026-04-14 11:13:03 -05:00

delmenu.vim

vim-patch:e978b4534a5e (#24697)

2023-08-13 13:25:10 +01:00

embedded_data.zig

build: ship "_core/*" as bytecode (built-into Nvim binary)

2025-12-30 01:44:24 -05:00

example_init.lua

feat(vim.hl): vim.hl.hl_op() #39777

2026-05-17 09:56:37 -04:00

filetype.lua

docs: use "ev" convention in event-handlers

2026-03-12 11:12:56 +01:00

ftoff.vim

vim-patch:e978b4534a5e (#24697)

2023-08-13 13:25:10 +01:00

ftplugin.vim

vim-patch:e978b4534a5e (#24697)

2023-08-13 13:25:10 +01:00

ftplugof.vim

vim-patch:e978b4534a5e (#24697)

2023-08-13 13:25:10 +01:00

gen_runtime.zig

fix(build): workaround errors in zig build due to stale cache

2025-08-22 19:10:43 +02:00

indent.vim

vim-patch:e978b4534a5e (#24697)

2023-08-13 13:25:10 +01:00

indoff.vim

vim-patch:e978b4534a5e (#24697)

2023-08-13 13:25:10 +01:00

makemenu.vim

vim-patch:9.2.0788: filetype: hip files are not recognized (#40809)

2026-07-18 22:19:48 +08:00

menu.vim

vim-patch:d5f173c: runtime(menu): fix space before Tab and trailing space

2026-01-20 07:56:50 +08:00

neovim.ico

feat(windows): show icon in terminal titlebar, taskbar #20607

2022-10-13 05:48:12 -07:00

nvim.png

…

org.neovim.nvim.appdata.xml

feat(build): rename io.neovim.nvim to org.neovim.nvim

2026-04-14 11:13:03 -05:00

org.neovim.nvim.desktop

feat(build): rename io.neovim.nvim to org.neovim.nvim

2026-04-14 11:13:03 -05:00

synmenu.vim

vim-patch:9.2.0788: filetype: hip files are not recognized (#40809)

2026-07-18 22:19:48 +08:00

windows_icon.rc

feat(win32): embed executable icon

2024-07-02 13:05:16 +02:00