Justin M. Keyes 799cbfff85 fix(vim.secure): read() command injection vulnerability #39918 ...

Problem:
Malicious filename can execute code because of ":" cmdline expansion.

Solution:
Use `fnameescape()`.

fix https://github.com/neovim/neovim/issues/39914

2026-05-20 15:27:43 -04:00

..

api

fix(api): nvim_exec_autocmds({buf=x}) runs in buffer context #39061

2026-05-20 03:48:55 -04:00

autocmd

docs: misc #39817

2026-05-17 10:02:12 -04:00

core

fix(messages): avoid recursive rtp build due to msg_show #39888

2026-05-20 08:13:41 -04:00

editor

feat(normal): lines textobject "il", "al" #39845

2026-05-19 05:08:23 -04:00

ex_cmds

feat(pack): :packupdate, :packdel commands #39693

2026-05-16 05:15:05 -04:00

fixtures

docs: misc, rename "tabpage"

2026-05-07 10:36:48 +02:00

harness

fix(test): support multiple --filter-out #39885

2026-05-20 09:03:45 -04:00

legacy

test: remove legacy/textobjects_spec.lua

2026-05-18 11:20:26 +02:00

lua

fix(vim.secure): read() command injection vulnerability #39918

2026-05-20 15:27:43 -04:00

options

docs: misc #39256

2026-04-25 11:16:18 -04:00

plugin

fix(pack): collect "Removed plugin" into one message #39840

2026-05-20 06:45:05 -04:00

provider

refactor(test): drop deprecated exc_exec #39242

2026-04-20 14:16:41 -04:00

script

fix(vim.iter): add richer generic annotations

2026-05-06 16:02:59 +01:00

shada

fix(shada): set correct buffer number for local marks on read #39712

2026-05-16 13:53:34 -04:00

terminal

feat(tui): $NVIM_TERMDEFS can override builtin terminfo #39555

2026-05-17 13:02:46 -04:00

testnvim

test: move exec_lua logic to separate module

2024-11-21 11:35:16 +00:00

treesitter

refactor(test): use public enum in select_spec #39665

2026-05-08 03:38:35 -04:00

ui

fix(fold): virtual lines duplicate foldopen (#39891)

2026-05-20 19:56:39 +08:00

vimscript

fix(vimscript): normalize multi-slash heads in fnamemodify() #39805

2026-05-17 10:54:59 -04:00

example_spec.lua

docs: dev-quickstart, dev-test #36304

2025-10-24 17:24:51 -07:00

preload.lua

test: replace busted with local harness

2026-04-15 12:09:25 +01:00

testnvim.lua

test: run Lua harness with nvim -l

2026-05-13 13:14:07 +01:00

testterm.lua

test(tui_spec): unskip a few more tests on Windows (#38618)

2026-03-31 00:54:53 +00:00