zeertzjq 8d1f8d8dc3 vim-patch:9.2.0840: [security]: code injection in netrw via bookmarks ...

Problem:  [security]: code injection in netrw via bookmarks and history
          (David Carliez)
Solution: Escape the '|' explicitly (Yasuhiro Matsumoto)

The bookmark and history menu builders interpolate paths into :execute'd
:menu commands using g:netrw_menu_escape, which did not escape the Ex
command separator '|'. A crafted path could break out of the :menu command
and run arbitrary Ex/shell commands when the menu was built or triggered.

Add '|' to g:netrw_menu_escape for the menu names, escape the :e right-hand
side with fnameescape(), and quote the netrw#MakeTgt() argument with
string() instead of raw single-quote interpolation.

Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2

29c6fd090d

Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>

2026-07-24 08:14:20 +08:00

..

dist/opt

vim-patch:9.2.0840: [security]: code injection in netrw via bookmarks

2026-07-24 08:14:20 +08:00