mirror of
https://github.com/vim/vim.git
synced 2026-05-24 11:07:07 +02:00
Christian Brabandt
79348dbbc0
Problem: [security]: Insufficient validation of hostname and port in
netrw URIs allows command injection via shell metacharacters
(ehdgks0627, un3xploitable).
Solution: Implement stricter RFC1123 hostname and IP validation.
Use shellescape() for the provided hostname and port.
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336
Signed-off-by: Christian Brabandt <cb@256bit.org>
