zeertzjq c4ce10930c vim-patch:9.2.0663: [security]: runtime(netrw): code injection in local file deletion ...

Problem:  [security]: s:NetrwLocalRmFile() escapes only the backslash in
          the file name before passing it to :execute, so a name
          containing "|" injects arbitrary Ex commands when the file is
          deleted (cipher-creator)
Solution: Use fnameescape() to correctly escape the file name
          (Yasuhiro Matsumoto).

Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-vhh8-v6wx-hjjh

Supported by AI

55bc757a5d

Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>

2026-06-17 15:22:04 +08:00

..

autoload

vim-patch:1fee3cd: runtime(beancount): Include Beancount runtime files

2026-06-14 09:37:00 +08:00

colors

vim-patch:c99aaf4: runtime(colors): improve catppuccin colorscheme

2026-02-01 08:22:07 +08:00

compiler

vim-patch:1fee3cd: runtime(beancount): Include Beancount runtime files

2026-06-14 09:37:00 +08:00

doc

feat(diagnostic): debounce current-line render #39542

2026-06-15 11:11:57 -04:00

ftplugin

vim-patch:1fee3cd: runtime(beancount): Include Beancount runtime files

2026-06-14 09:37:00 +08:00

indent

vim-patch:1fee3cd: runtime(beancount): Include Beancount runtime files

2026-06-14 09:37:00 +08:00

keymap

vim-patch:5c855ce: runtime: convert *_utf-8.vim files to actual UTF-8 encoding

2026-01-26 06:53:53 +08:00

lua

fix(lsp): catch another nil buffer state #40285

2026-06-16 16:20:17 -04:00

pack/dist/opt

vim-patch:9.2.0663: [security]: runtime(netrw): code injection in local file deletion

2026-06-17 15:22:04 +08:00

plugin

feat(autoread): use filewatchers for OS-driven change detection #37971

2026-06-12 18:25:15 -04:00

queries

build(deps): bump tree-sitter-lua to v0.5.0

2026-02-26 19:26:35 +01:00

scripts

feat(tui): restore 'ttyfast' to control tty requests #38699

2026-04-24 14:45:20 -04:00

spell

…

syntax

vim-patch:c6705b2: runtime(erlang): Optimize operators and bitstring types (#40278)

2026-06-16 09:12:22 +08:00

tutor

refactor(tutor): use inline comments instead of json file #39714

2026-05-13 07:31:17 -04:00

CMakeLists.txt

feat(build): rename io.neovim.nvim to org.neovim.nvim

2026-04-14 11:13:03 -05:00

delmenu.vim

…

embedded_data.zig

build: ship "_core/*" as bytecode (built-into Nvim binary)

2025-12-30 01:44:24 -05:00

example_init.lua

feat(vim.hl): vim.hl.hl_op() #39777

2026-05-17 09:56:37 -04:00

filetype.lua

docs: use "ev" convention in event-handlers

2026-03-12 11:12:56 +01:00

ftoff.vim

…

ftplugin.vim

…

ftplugof.vim

…

gen_runtime.zig

fix(build): workaround errors in zig build due to stale cache

2025-08-22 19:10:43 +02:00

indent.vim

…

indoff.vim

…

makemenu.vim

vim-patch:9.1.1647: filetype: Cangjie files are not recognized

2025-08-20 07:23:49 +08:00

menu.vim

vim-patch:d5f173c: runtime(menu): fix space before Tab and trailing space

2026-01-20 07:56:50 +08:00

neovim.ico

…

nvim.png

…

org.neovim.nvim.appdata.xml

feat(build): rename io.neovim.nvim to org.neovim.nvim

2026-04-14 11:13:03 -05:00

org.neovim.nvim.desktop

feat(build): rename io.neovim.nvim to org.neovim.nvim

2026-04-14 11:13:03 -05:00

synmenu.vim

vim-patch:9.1.1647: filetype: Cangjie files are not recognized

2025-08-20 07:23:49 +08:00

windows_icon.rc

feat(win32): embed executable icon

2024-07-02 13:05:16 +02:00