Justin M. Keyes f83e0dcaf8 fix(vim.secure): read() command injection vulnerability #39918 ...

Problem:
Malicious filename can execute code because of ":" cmdline expansion.

Solution:
Use `fnameescape()`.

fix https://github.com/neovim/neovim/issues/39914

(cherry picked from commit 799cbfff85)

2026-05-20 20:00:45 +00:00

..

api

fix(api): adjust Visual position after nvim_buf_set_text #30690

2026-05-18 17:32:06 +00:00

autocmd

backport: refactor(test): drop deprecated exc_exec #39255

2026-04-21 16:22:05 +00:00

core

fix(messages): avoid recursive rtp build due to msg_show #39888

2026-05-20 13:04:08 +00:00

editor

backport: refactor(test): drop deprecated exc_exec #39255

2026-04-21 16:22:05 +00:00

ex_cmds

fix(help): fix CTRL character issue for :help {subject} #39537

2026-05-01 10:50:35 +00:00

fixtures

docs: misc, rename "tabpage"

2026-05-07 12:03:02 +02:00

harness

test: include test path in summary (#39141)

2026-04-17 14:08:02 +00:00

legacy

fix(prompt): handle multi-element lists in prompt_appendbuf #39550

2026-05-12 16:54:29 +00:00

lua

fix(vim.secure): read() command injection vulnerability #39918

2026-05-20 20:00:45 +00:00

options

backport: docs: misc, window (#39722)

2026-05-11 21:06:59 +00:00

plugin

fix(difftool): handle filenames containing spaces #39740

2026-05-15 01:04:43 +00:00

provider

backport: refactor(test): drop deprecated exc_exec #39255

2026-04-21 16:22:05 +00:00

script

feat(docs): render class dot members as module functions

2026-04-26 12:39:45 +02:00

shada

fix(shada): set correct buffer number for local marks on read #39712

2026-05-16 22:24:49 +00:00

terminal

fix(startup): emitting useless OptionSet

2026-05-17 18:24:50 +02:00

testnvim

test: move exec_lua logic to separate module

2024-11-21 11:35:16 +00:00

treesitter

refactor(test): use public enum in select_spec #39665

2026-05-08 08:00:12 +00:00

ui

fix(fold): virtual lines duplicate foldopen (#39891)

2026-05-20 12:53:14 +00:00

vimscript

fix(shell): preserve CR when :! outputs to binary-mode buffer #39558

2026-05-08 08:11:25 +00:00

example_spec.lua

docs: dev-quickstart, dev-test #36304

2025-10-24 17:24:51 -07:00

preload.lua

test: replace busted with local harness

2026-04-15 19:47:10 +02:00

testnvim.lua

backport: refactor(test): drop deprecated exc_exec #39255

2026-04-21 16:22:05 +00:00

testterm.lua

test(tui_spec): unskip a few more tests on Windows (#38618)

2026-03-31 02:12:29 +00:00