From: pyllyukko <pyllyukko@maimed.org>
Date: Thu, 19 Mar 2026 19:58:05 +0000 (+0000)
Subject: patch 9.2.0202: [security]: command injection via newline in glob()
X-Git-Tag: v9.2.0202^0
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=645ed6597d1ea896c712cd7ddbb6edee79577e9a;p=thirdparty%2Fvim.git

patch 9.2.0202: [security]: command injection via newline in glob()

Problem:  The glob() function on Unix-like systems does not escape
          newline characters when expanding wildcards. A maliciously
          crafted string containing '\n' can be used as a command
          separator to execute arbitrary shell commands via
          mch_expand_wildcards(). This depends on the user's 'shell'
          setting.
Solution: Add the newline character ('\n') to the SHELL_SPECIAL
          definition to ensure it is properly escaped before being
          passed to the shell (pyllyukko).

closes: #19746

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c

Signed-off-by: pyllyukko <pyllyukko@maimed.org>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/os_unix.c b/src/os_unix.c
index 03f7649090..91bfd63d0d 100644
--- a/src/os_unix.c
+++ b/src/os_unix.c
@@ -7075,7 +7075,7 @@ mch_expandpath(
 #  define SEEK_END 2
 # endif
 
-# define SHELL_SPECIAL (char_u *)"\t \"&'$;<>()\\|"
+# define SHELL_SPECIAL (char_u *)"\t \"&'$;<>()\\|\n"
 
     int
 mch_expand_wildcards(
diff --git a/src/version.c b/src/version.c
index f4d0d87aee..79de52f6aa 100644
--- a/src/version.c
+++ b/src/version.c
@@ -734,6 +734,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    202,
 /**/
     201,
 /**/