mirror of
https://github.com/vim/vim.git
synced 2026-05-06 12:26:58 -04:00
Christian Brabandt
190cb3c2b9
Problem: [security]: Backticks enclosed shell commands in the 'path'
option value are executed during completion (q1uf3ng).
Solution: Skip path entries containing backticks, add P_SECURE to 'path'
option, so that it cannot be set from a modeline (for symmetry with
the 'cdpath' option)
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-hwg5-3cxw-wvvg
Supported by AI.
Signed-off-by: Christian Brabandt <cb@256bit.org>
